Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
8Rmoal0v85.exe

Overview

General Information

Sample name:8Rmoal0v85.exe
renamed because original name is a hash value
Original sample name:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20.exe
Analysis ID:1586710
MD5:9c4e46ef2e0ad08e7040de7b3c1e60e7
SHA1:72d4a6613e520cb8b39e1ac4b347270cc1450fff
SHA256:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20
Tags:exeuser-crep1x
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

  • System is w10x64
  • 8Rmoal0v85.exe (PID: 3504 cmdline: "C:\Users\user\Desktop\8Rmoal0v85.exe" MD5: 9C4E46EF2E0AD08E7040DE7B3C1E60E7)
    • 8Rmoal0v85.exe (PID: 5132 cmdline: "C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=520 -burn.filehandle.self=512 MD5: 9C540950F5A8981844FF33BFC55D2F36)
      • AdobeSync.exe (PID: 5376 cmdline: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
        • AdobeSync.exe (PID: 1588 cmdline: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
          • cmd.exe (PID: 5328 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 2888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • LocalCtrl_alpha_v3.exe (PID: 5608 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • AdobeSync.exe (PID: 3504 cmdline: "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe" MD5: F778E9136AB0DB9DE9802A7043DE50A7)
    • cmd.exe (PID: 6248 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • LocalCtrl_alpha_v3.exe (PID: 1968 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\bgjyfakxiReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\idsvevgmlxihlReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Multi AV Scanner detection for submitted file
Source: 8Rmoal0v85.exeReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\idsvevgmlxihlJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bgjyfakxiJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A9A0BB DecryptFileW,0_2_00A9A0BB
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABFA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,0_2_00ABFA62
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A99E9E DecryptFileW,DecryptFileW,0_2_00A99E9E
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005EA0BB DecryptFileW,2_2_005EA0BB
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,2_2_0060FA62
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005E9E9E DecryptFileW,DecryptFileW,2_2_005E9E9E
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004F0070 CryptUnprotectData,_CxxThrowException,3_2_004F0070
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004F00D0 CryptProtectData,_CxxThrowException,3_2_004F00D0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01030070 CryptUnprotectData,_CxxThrowException,4_2_01030070
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_010300D0 CryptProtectData,_CxxThrowException,4_2_010300D0
Source: 8Rmoal0v85.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dllJump to behavior
Source: 8Rmoal0v85.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 8Rmoal0v85.exe, 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2180810939.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2183959748.000000000061B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp.m source: AdobeSync.exe, 00000004.00000002.2271677340.000000006D2E0000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 8Rmoal0v85.exe, 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692413823.00000000060EF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693803202.0000000006AEF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688970942.00000000048EA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693122597.00000000066EE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694118067.0000000006CE9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689937095.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690372393.00000000054EC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692932212.00000000064E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688504772.00000000044E5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690842101.00000000058E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690140509.00000000052E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692193986.0000000005EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2695142025.00000000072E3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688110574.00000000040E7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686558976.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2685751132.0000000002383000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688713717.00000000046E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687517240.0000000003CE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694579837.00000000070E6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690586209.00000000056E1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687825536.0000000003EEB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691346756.0000000005AE5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689698854.0000000004EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689487957.0000000004CEA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694354603.0000000006EE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691966844.0000000005CE1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689277149.0000000004AEE000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2211844614.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2212042522.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270296782.000000000A740000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270595852.000000000AAFB000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270157026.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578609852.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578055011.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562666404.000000000A4B2000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562196319.0000000009DA2000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562400454.000000000A100000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2686889000.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685013729.00000000048D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692413823.00000000060EF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693803202.0000000006AEF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688970942.00000000048EA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693122597.00000000066EE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694118067.0000000006CE9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689937095.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690372393.00000000054EC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692932212.00000000064E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688504772.00000000044E5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690842101.00000000058E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690140509.00000000052E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692193986.0000000005EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2695142025.00000000072E3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688110574.00000000040E7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686558976.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2685751132.0000000002383000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688713717.00000000046E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687517240.0000000003CE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694579837.00000000070E6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690586209.00000000056E1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687825536.0000000003EEB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691346756.0000000005AE5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689698854.0000000004EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689487957.0000000004CEA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694354603.0000000006EE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691966844.0000000005CE1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689277149.0000000004AEE0
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2211844614.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2212042522.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270296782.000000000A740000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270595852.000000000AAFB000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270157026.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578609852.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578055011.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562666404.000000000A4B2000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562196319.0000000009DA2000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562400454.000000000A100000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2686889000.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685013729.00000000048D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 8Rmoal0v85.exe, 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000002.2213630350.000000006CF81000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000003.2203055785.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271555165.000000006D2B1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2563931959.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2188357564.000000000052D000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2202793188.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2206771785.000000000052D000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.2265940055.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000000.2205428142.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000000.2494283860.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.2554784134.000000000106D000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000003.2202882083.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213863768.000000006CFB0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2271677340.000000006D2E0000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.2564198296.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000002.2213630350.000000006CF81000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000003.2203055785.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271555165.000000006D2B1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2563931959.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000003.2202882083.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213863768.000000006CFB0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 0000000B.00000002.2564198296.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A83CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00A83CC4
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC4440 FindFirstFileW,FindClose,0_2_00AC4440
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB7B87 FindFirstFileExW,0_2_00AB7B87
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A99B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,0_2_00A99B43
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00614440 FindFirstFileW,FindClose,2_2_00614440
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005E9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_005E9B43
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00607B87 FindFirstFileExW,2_2_00607B87
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005D3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_005D3CC4
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFCDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6CFCDCB0
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDDB36 FindFirstFileExW,2_2_6CFDDB36
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004ACE10 FindFirstFileW,3_2_004ACE10
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004ABB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,3_2_004ABB70
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004BFD50 free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,FindFirstFileA,FindClose,free,free,free,free,free,free,free,free,3_2_004BFD50
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00FECE10 FindFirstFileW,4_2_00FECE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00FEBB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_00FEBB70
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: unknownDNS traffic detected: query: tataragirld.site replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004A4970 HttpSendRequestA,printf,_CxxThrowException,HttpSendRequestA,InternetReadFile,_CxxThrowException,HttpEndRequestA,3_2_004A4970
Source: global trafficDNS traffic detected: DNS query: tataragirld.site
Source: 8Rmoal0v85.exeString found in binary or memory: http://appsyndication.org/2006/appsyn
Source: 8Rmoal0v85.exe, 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2180810939.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2183959748.000000000061B000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.???.xx/?search=%s
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.0000000008853000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004D87000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.0000000008082000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.000000000278C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C3C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000000.2642443538.0000000140156000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.surfok.de/
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2677554183.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000522000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2674418030.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/)
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/)Y
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2782392322.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/.
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2677554183.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2679045527.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/1
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?om
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2785621971.000000000044F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2BgLgGV
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.0000000000539000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2684112962.000000000053B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?oms
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/5
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/9
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2779071914.0000000000470000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/:
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2672784438.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2673007159.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2679045527.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000522000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/=
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/=Y
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2673007159.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2674418030.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/e
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/eYO
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/m
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/n
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2670039373.0000000000523000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/u
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/v
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000503000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2672784438.0000000000503000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2Bg
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680855015.0000000000555000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680605761.0000000000553000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:4438
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682306575.000000000055A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443F
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile deleted: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB001D0_2_00AB001D
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AA41EA0_2_00AA41EA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A862AA0_2_00A862AA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB03D50_2_00AB03D5
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAC3320_2_00AAC332
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABA5600_2_00ABA560
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB07AA0_2_00AB07AA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A8A8F10_2_00A8A8F1
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABAA0E0_2_00ABAA0E
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAFB890_2_00AAFB89
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB0B6F0_2_00AB0B6F
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB2C180_2_00AB2C18
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABEE7C0_2_00ABEE7C
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB2E470_2_00AB2E47
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060001D2_2_0060001D
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005F41EA2_2_005F41EA
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005D62AA2_2_005D62AA
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FC3322_2_005FC332
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_006003D52_2_006003D5
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060A5602_2_0060A560
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_006007AA2_2_006007AA
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005DA8F12_2_005DA8F1
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060AA0E2_2_0060AA0E
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00600B6F2_2_00600B6F
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FFB892_2_005FFB89
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00602C182_2_00602C18
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060EE7C2_2_0060EE7C
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00602E472_2_00602E47
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFC4EA02_2_6CFC4EA0
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDBF892_2_6CFDBF89
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE2F422_2_6CFE2F42
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD64E02_2_6CFD64E0
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFC35702_2_6CFC3570
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE30622_2_6CFE3062
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD21B02_2_6CFD21B0
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD52552_2_6CFD5255
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDF3DF2_2_6CFDF3DF
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDB3DB2_2_6CFDB3DB
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004C76103_2_004C7610
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_010076104_2_01007610
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 006132F3 appears 85 times
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 6CFD0F70 appears 47 times
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 005D3821 appears 501 times
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 00610237 appears 683 times
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 00610726 appears 34 times
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: String function: 005D1F13 appears 54 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00AC32F3 appears 83 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00A83821 appears 501 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00A81F13 appears 54 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00AC0237 appears 683 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00AC0726 appears 34 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00F96970 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00F95A10 appears 94 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00FE8490 appears 646 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 01035F10 appears 47 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 01058A9E appears 32 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00FB4080 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00F91013 appears 40 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 00518A9E appears 32 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 004F5F10 appears 88 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 00474080 appears 43 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 004B59E0 appears 53 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 004A8490 appears 646 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 00455A10 appears 94 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 00451013 appears 40 times
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: String function: 00456970 appears 43 times
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
Source: idsvevgmlxihl.5.drStatic PE information: Number of sections : 12 > 10
Source: bgjyfakxi.13.drStatic PE information: Number of sections : 12 > 10
Source: 8Rmoal0v85.exe, 00000000.00000000.2180850430.0000000000AED000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000002.2191854894.000000006CFFD000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenameSharePoint.dllF vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite.dllX vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: classification engineClassification label: mal84.evad.winEXE@18/26@2/0
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABFE21 FormatMessageW,GetLastError,LocalFree,0_2_00ABFE21
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A845EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,0_2_00A845EE
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005D45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,2_2_005D45EE
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,0_2_00AC304F
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFC7F40 LoadResource,LockResource,SizeofResource,2_2_6CFC7F40
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AA6B88 ChangeServiceConfigW,GetLastError,0_2_00AA6B88
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCFJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2888:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_03
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\Jump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: cabinet.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: msi.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: version.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: wininet.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: comres.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: clbcatq.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: msasn1.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: crypt32.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: feclient.dll0_2_00A81070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: cabinet.dll0_2_00A81070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: msi.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: version.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: wininet.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: comres.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: clbcatq.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: msasn1.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: crypt32.dll2_2_005D1070
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCommand line argument: feclient.dll2_2_005D1070
Source: 8Rmoal0v85.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 8Rmoal0v85.exe, 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: SELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmp;.\\?\\\?\UNC\\\invalid string position\ *AI_WSP_LISTAI_WSP_FEATURES_LIST[AI_WSP_URL]AI_SHAREPOINT_LOGAI_GLOBAL_WSPAI_LOCAL_WSPAI_NOT_VITAL_WSPAI_DEPLOY_WSP_CADATAAI_DEPLOY_WSP_CADATA_64AI_SHAREPOINT_STRINGS,|$^.cab.wspSharePoint.log-url [AI_WSP_URL] -allcontenturls-immediate-time-local-allowgacdeployment-allowcaspolicies-force-idSPAdminSPAdminV4SPTimerV3SPTimerV4
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 8Rmoal0v85.exe, 00000002.00000003.2187819757.0000000001296000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213407575.000000006CF63000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2203808871.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271403860.000000006D293000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2563371596.000000006CB43000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 8Rmoal0v85.exeReversingLabs: Detection: 42%
Source: 8Rmoal0v85.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: 8Rmoal0v85.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile read: C:\Users\user\Desktop\8Rmoal0v85.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\8Rmoal0v85.exe "C:\Users\user\Desktop\8Rmoal0v85.exe"
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=520 -burn.filehandle.self=512
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=520 -burn.filehandle.self=512 Jump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: rqgcqbnwl.5.drLNK file: ..\..\Roaming\PatchReaderWCF\AdobeSync.exe
Source: 8Rmoal0v85.exeStatic file information: File size 7012352 > 1048576
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dllJump to behavior
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 8Rmoal0v85.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 8Rmoal0v85.exe, 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2180810939.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2183959748.000000000061B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp.m source: AdobeSync.exe, 00000004.00000002.2271677340.000000006D2E0000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 8Rmoal0v85.exe, 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692413823.00000000060EF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693803202.0000000006AEF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688970942.00000000048EA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693122597.00000000066EE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694118067.0000000006CE9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689937095.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690372393.00000000054EC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692932212.00000000064E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688504772.00000000044E5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690842101.00000000058E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690140509.00000000052E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692193986.0000000005EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2695142025.00000000072E3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688110574.00000000040E7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686558976.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2685751132.0000000002383000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688713717.00000000046E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687517240.0000000003CE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694579837.00000000070E6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690586209.00000000056E1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687825536.0000000003EEB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691346756.0000000005AE5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689698854.0000000004EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689487957.0000000004CEA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694354603.0000000006EE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691966844.0000000005CE1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689277149.0000000004AEE000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2211844614.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2212042522.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270296782.000000000A740000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270595852.000000000AAFB000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270157026.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578609852.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578055011.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562666404.000000000A4B2000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562196319.0000000009DA2000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562400454.000000000A100000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2686889000.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685013729.00000000048D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692413823.00000000060EF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693803202.0000000006AEF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688970942.00000000048EA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2693122597.00000000066EE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694118067.0000000006CE9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689937095.00000000050E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690372393.00000000054EC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692932212.00000000064E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688504772.00000000044E5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690842101.00000000058E9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690140509.00000000052E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2692193986.0000000005EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2695142025.00000000072E3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688110574.00000000040E7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686558976.0000000002D00000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2685751132.0000000002383000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2688713717.00000000046E4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687517240.0000000003CE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694579837.00000000070E6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2690586209.00000000056E1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2687825536.0000000003EEB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691346756.0000000005AE5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689698854.0000000004EEC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689487957.0000000004CEA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2694354603.0000000006EE6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2691966844.0000000005CE1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2689277149.0000000004AEE0
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2211844614.0000000009ABD000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2212042522.0000000009E10000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270296782.000000000A740000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270595852.000000000AAFB000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2270157026.000000000A3EC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578609852.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578055011.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562666404.000000000A4B2000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562196319.0000000009DA2000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2562400454.000000000A100000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2686889000.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685013729.00000000048D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 8Rmoal0v85.exe, 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000002.2213630350.000000006CF81000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000003.2203055785.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271555165.000000006D2B1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2563931959.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2188357564.000000000052D000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2202793188.0000000000CA7000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2206771785.000000000052D000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.2265940055.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000000.2205428142.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000000.2494283860.000000000106D000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.2554784134.000000000106D000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000003.2202882083.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213863768.000000006CFB0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2271677340.000000006D2E0000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.2564198296.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000002.2213630350.000000006CF81000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000003.2203055785.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2271555165.000000006D2B1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2563931959.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000003.2202882083.0000000000C80000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2213863768.000000006CFB0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 0000000B.00000002.2564198296.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: Quadruple.dll.2.drStatic PE information: real checksum: 0x4dc7e should be: 0x4a7b1
Source: 8Rmoal0v85.exeStatic PE information: real checksum: 0x0 should be: 0x6bfb22
Source: idsvevgmlxihl.5.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: AXE8SharedExpat.dll.3.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: AXE8SharedExpat.dll.2.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: bgjyfakxi.13.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: 8Rmoal0v85.exeStatic PE information: section name: .wixburn
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: section name: Shared
Source: idsvevgmlxihl.5.drStatic PE information: section name: .xdata
Source: idsvevgmlxihl.5.drStatic PE information: section name: ubpux
Source: bgjyfakxi.13.drStatic PE information: section name: .xdata
Source: bgjyfakxi.13.drStatic PE information: section name: ubpux
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAEAD6 push ecx; ret 0_2_00AAEAE9
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FEAD6 push ecx; ret 2_2_005FEAE9
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD0FB4 push ecx; ret 2_2_6CFD0FC6
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00518249 push ecx; ret 3_2_0051825C
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00518B07 push ecx; ret 3_2_00518B1A
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01058249 push ecx; ret 4_2_0105825C
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01058B07 push ecx; ret 4_2_01058B1A
Source: msvcr90.dll.2.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.3.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dllJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\idsvevgmlxihlJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\bgjyfakxiJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllJump to dropped file
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\idsvevgmlxihlJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\bgjyfakxiJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\IDSVEVGMLXIHL
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\BGJYFAKXI
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFCFBC5 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_6CFCFBC5

Malware Analysis System Evasion

barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CC77C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CC77C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CC77945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CC73B54
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\idsvevgmlxihlJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\bgjyfakxiJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeEvaded block: after key decision
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeEvaded block: after key decision
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeEvaded block: after key decision
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeAPI coverage: 9.7 %
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe TID: 3152Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 7144Thread sleep time: -35996s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6068Thread sleep time: -120000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6780Thread sleep time: -35996s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 5984Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 4368Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00ABFF61h0_2_00ABFEC6
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00ABFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00ABFF5Ah0_2_00ABFEC6
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0060FF61h2_2_0060FEC6
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_0060FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0060FF5Ah2_2_0060FEC6
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A83CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00A83CC4
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC4440 FindFirstFileW,FindClose,0_2_00AC4440
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB7B87 FindFirstFileExW,0_2_00AB7B87
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A99B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,0_2_00A99B43
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00614440 FindFirstFileW,FindClose,2_2_00614440
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005E9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_005E9B43
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00607B87 FindFirstFileExW,2_2_00607B87
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005D3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_005D3CC4
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFCDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6CFCDCB0
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDDB36 FindFirstFileExW,2_2_6CFDDB36
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004ACE10 FindFirstFileW,3_2_004ACE10
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004ABB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,3_2_004ABB70
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_004BFD50 free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,FindFirstFileA,FindClose,free,free,free,free,free,free,free,free,3_2_004BFD50
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00FECE10 FindFirstFileW,4_2_00FECE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00FEBB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_00FEBB70
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC97A5 VirtualQuery,GetSystemInfo,0_2_00AC97A5
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeThread delayed: delay time: 30000Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004BC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWWg
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
Source: cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
Source: C:\Users\user\Desktop\8Rmoal0v85.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AAE88A
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00451412 OutputDebugStringA,GetLastError,3_2_00451412
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB48D8 mov eax, dword ptr fs:[00000030h]0_2_00AB48D8
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_006048D8 mov eax, dword ptr fs:[00000030h]2_2_006048D8
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDD82F mov eax, dword ptr fs:[00000030h]2_2_6CFDD82F
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD72E9 mov eax, dword ptr fs:[00000030h]2_2_6CFD72E9
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A8394F GetProcessHeap,RtlAllocateHeap,0_2_00A8394F
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00AAE3D8
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AAE88A
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAE9DC SetUnhandledExceptionFilter,0_2_00AAE9DC
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AB3C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00AB3C76
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_005FE3D8
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_005FE88A
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_005FE9DC SetUnhandledExceptionFilter,2_2_005FE9DC
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_00603C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00603C76
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD0C6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6CFD0C6C
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD3EDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6CFD3EDE
Source: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD03FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_6CFD03FB
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_0051762E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,3_2_0051762E
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0105762E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,4_2_0105762E

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6A32641F8Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x6FD52240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x14011D93EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A32F7F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6A34654B3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF770D897BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF770D67F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF770D68D66Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770CD991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF6A32F8D66Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x6D2C2240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6A32F1CB2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770CDFD88Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF6A3462F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770CE1B12Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF770D702F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6A34654D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF770D6F9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A327187AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF770D8A7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x14011D808Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6A3263FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A347299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A32E4EF6Jump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeNtProtectVirtualMemory: Direct from: 0x77377B2EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6A346325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A32F8D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF770ED79C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770EE09E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770CD3E52Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF770D86EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A3466770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A3316EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6A3370DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF770D61CB2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF770ED79D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A32ED940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF770D89EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A32FD226Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A32E4E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6A32FF369Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6A331AAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A32FA90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A3349090Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A32F838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A32EDD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6A33002F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF770D5D940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770D6838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6A3319EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770ED6342Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF770ED79E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FFDB4404B5EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770D68D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770EE2A76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A326991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6A32FFBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF770D6F369Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtQuerySystemInformation: Direct from: 0x773763E1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6A34679C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF770ED54B3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770D5DD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770D6D226Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF6A33197BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF770D8AAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6A32F8C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770D54E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770D6A90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF770DE0DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6A32FF270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A3346678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6A331A7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770D6FBFDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x14011D832Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF770DB6678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF770D89DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FFDB43E26A1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF770ED2F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationThread: Direct from: 0x7FF6A34709E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6A34679D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF770D6F270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A3263E52Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x14011D7A4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770EE299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A326B119Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6A32612F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF770ED6770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6A3319DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF770CD3FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6A34679E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6A32FF9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF770ED54D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x140120A3CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF770CD41F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF770ED325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF770D68C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF770D54EF6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A3466342Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6A3472A76Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 369010Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 267010Jump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=520 -burn.filehandle.self=512 Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC1719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,0_2_00AC1719
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC3A5F AllocateAndInitializeSid,CheckTokenMembership,0_2_00AC3A5F
Source: AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AAEC07 cpuid 0_2_00AAEC07
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A94EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,0_2_00A94EDF
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A86037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,0_2_00A86037
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A861DF GetUserNameW,GetLastError,0_2_00A861DF
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00AC887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,0_2_00AC887B
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00A85195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,0_2_00A85195
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513BC0 sqlite3_bind_parameter_count,3_2_00513BC0
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513BE0 sqlite3_bind_int,3_2_00513BE0
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513C40 sqlite3_bind_int64,3_2_00513C40
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513C70 sqlite3_bind_double,3_2_00513C70
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513C10 sqlite3_bind_int,3_2_00513C10
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513CA0 sqlite3_bind_text,3_2_00513CA0
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513DC0 sqlite3_bind_blob,3_2_00513DC0
Source: C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exeCode function: 3_2_00513E10 sqlite3_bind_null,3_2_00513E10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053BC0 sqlite3_bind_parameter_count,4_2_01053BC0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053BE0 sqlite3_bind_int,4_2_01053BE0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053DC0 sqlite3_bind_blob,4_2_01053DC0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053C10 sqlite3_bind_int,4_2_01053C10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053C40 sqlite3_bind_int64,4_2_01053C40
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053C70 sqlite3_bind_double,4_2_01053C70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053CA0 sqlite3_bind_text,4_2_01053CA0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_01053E10 sqlite3_bind_null,4_2_01053E10

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Native API		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		OS Credential Dumping12
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts3
Command and Scripting Interpreter		1
Windows Service		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		LSASS Memory1
Account Discovery		Remote Desktop ProtocolData from Removable Media2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		Logon Script (Windows)1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Windows Service		1
Software Packing		NTDS135
System Information Discovery		Distributed Component Object ModelInput Capture1
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script213
Process Injection		11
DLL Side-Loading		LSA Secrets231
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
File Deletion		Cached Domain Credentials2
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Masquerading		DCSync11
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Virtualization/Sandbox Evasion		Proc Filesystem1
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron213
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1586710 Sample: 8Rmoal0v85.exe Startdate: 09/01/2025 Architecture: WINDOWS Score: 84 67 tataragirld.site 2->67 69 Multi AV Scanner detection for dropped file 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 Machine Learning detection for dropped file 2->73 75 AI detected suspicious sample 2->75 11 8Rmoal0v85.exe 3 2->11         started        14 AdobeSync.exe 1 2->14         started        signatures3 process4 file5 65 C:\Windows\Temp\...\8Rmoal0v85.exe, Unknown 11->65 dropped 17 8Rmoal0v85.exe 15 11->17         started        95 Maps a DLL or memory area into another process 14->95 97 Found direct / indirect Syscall (likely to bypass EDR) 14->97 20 cmd.exe 2 14->20         started        signatures6 process7 file8 43 C:\Windows\Temp\...\sqlite.dll, PE32 17->43 dropped 45 C:\Windows\Temp\...\Quadruple.dll, PE32 17->45 dropped 47 C:\Windows\Temp\...\BIB.dll, PE32 17->47 dropped 51 4 other files (2 malicious) 17->51 dropped 23 AdobeSync.exe 9 17->23         started        49 C:\Users\user\AppData\Local\Temp\bgjyfakxi, PE32+ 20->49 dropped 85 Writes to foreign memory regions 20->85 87 Maps a DLL or memory area into another process 20->87 27 LocalCtrl_alpha_v3.exe 20->27         started        29 conhost.exe 20->29         started        signatures9 process10 file11 57 C:\Users\user\AppData\Roaming\...\sqlite.dll, PE32 23->57 dropped 59 C:\Users\user\AppData\Roaming\...\BIB.dll, PE32 23->59 dropped 61 C:\Users\user\AppData\...\AdobeSync.exe, PE32 23->61 dropped 63 3 other files (1 malicious) 23->63 dropped 91 Switches to a custom stack to bypass stack traces 23->91 93 Found direct / indirect Syscall (likely to bypass EDR) 23->93 31 AdobeSync.exe 1 23->31         started        signatures12 process13 signatures14 99 Maps a DLL or memory area into another process 31->99 101 Switches to a custom stack to bypass stack traces 31->101 103 Found direct / indirect Syscall (likely to bypass EDR) 31->103 34 cmd.exe 5 31->34         started        process15 file16 53 C:\Users\user\AppData\Local\...\idsvevgmlxihl, PE32+ 34->53 dropped 55 C:\Users\user\...\LocalCtrl_alpha_v3.exe, PE32+ 34->55 dropped 77 Writes to foreign memory regions 34->77 79 Found hidden mapped module (file has been removed from disk) 34->79 81 Maps a DLL or memory area into another process 34->81 83 Switches to a custom stack to bypass stack traces 34->83 38 LocalCtrl_alpha_v3.exe 34->38         started        41 conhost.exe 34->41         started        signatures17 process18 signatures19 89 Found direct / indirect Syscall (likely to bypass EDR) 38->89

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
8Rmoal0v85.exe42%ReversingLabsWin32.Trojan.Rugmi

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\idsvevgmlxihl100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bgjyfakxi100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\bgjyfakxi24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Local\Temp\idsvevgmlxihl24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\BIB.dll0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\Quadruple.dll0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcp90.dll0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dll0%ReversingLabs
C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\sqlite.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.softwareok.de/?Download=Find.Same.Images.OK0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_season?oms0%Avira URL Cloudsafe
https://tataragirld.site/)0%Avira URL Cloudsafe
https://tataragirld.site/e0%Avira URL Cloudsafe
https://tataragirld.site/)Y0%Avira URL Cloudsafe
https://tataragirld.site:443F0%Avira URL Cloudsafe
https://tataragirld.site/=Y0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK0%Avira URL Cloudsafe
http://www.???.xx/?search=%s0%Avira URL Cloudsafe
https://tataragirld.site/=0%Avira URL Cloudsafe
https://tataragirld.site/0%Avira URL Cloudsafe
https://tataragirld.site:44380%Avira URL Cloudsafe
http://www.softwareok.de0%Avira URL Cloudsafe
https://tataragirld.site/:0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History0%Avira URL Cloudsafe
https://tataragirld.site/m0%Avira URL Cloudsafe
https://tataragirld.site/eYO0%Avira URL Cloudsafe
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=00%Avira URL Cloudsafe
https://tataragirld.site/.0%Avira URL Cloudsafe
https://tataragirld.site/50%Avira URL Cloudsafe
https://tataragirld.site/n0%Avira URL Cloudsafe
https://tataragirld.site/10%Avira URL Cloudsafe
http://www.surfok.de/0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_season?om0%Avira URL Cloudsafe
https://tataragirld.site/20%Avira URL Cloudsafe
https://tataragirld.site:4430%Avira URL Cloudsafe
https://tataragirld.site/u0%Avira URL Cloudsafe
https://tataragirld.site/90%Avira URL Cloudsafe
https://tataragirld.site/v0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
tataragirld.site
unknown
unknownfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.vmware.com/0AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
      		high
      http://www.softwareok.com/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
        		high
        https://tataragirld.site/eLocalCtrl_alpha_v3.exe, 0000000C.00000003.2673007159.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2674418030.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://www.softwareok.com/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
          		high
          http://www.softwareok.de/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/)LocalCtrl_alpha_v3.exe, 0000000C.00000003.2677554183.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000522000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2674418030.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/)YLocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/2009_New_England_Patriots_season?omsLocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.0000000000539000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2684112962.000000000053B000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.vmware.com/0/AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            https://tataragirld.site:443FLocalCtrl_alpha_v3.exe, 0000000C.00000003.2682306575.000000000055A000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://tataragirld.site/=YLocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
              		high
              http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor8Rmoal0v85.exe, 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2180810939.0000000000ACB000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2183959748.000000000061B000.00000002.00000001.01000000.00000005.sdmpfalse
                		high
                http://www.???.xx/?search=%sAdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.symauth.com/cps0(AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://www.softwareok.de/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/=LocalCtrl_alpha_v3.exe, 0000000C.00000003.2672784438.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2673007159.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2679045527.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000522000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/:LocalCtrl_alpha_v3.exe, 00000010.00000003.2779071914.0000000000470000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site:4438LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680855015.0000000000555000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680605761.0000000000553000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.symauth.com/rpa00AdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.softwareok.deAdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.info-zip.org/AdobeSync.exe, 00000003.00000002.2211313464.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.0000000008853000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004D87000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.0000000008082000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.000000000278C000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C3C000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://tataragirld.site/mLocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.de/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://tataragirld.site/eYOLocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.00000000004E9000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://tataragirld.site/1LocalCtrl_alpha_v3.exe, 0000000C.00000003.2677554183.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2679045527.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://tataragirld.site/2009_New_England_Patriots_season?omLocalCtrl_alpha_v3.exe, 0000000C.00000002.2684578325.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.com/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000000.2642537169.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                        		high
                        https://tataragirld.site/.LocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2782392322.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site/nLocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2791787798.000000000046A000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.surfok.de/LocalCtrl_alpha_v3.exe, 00000010.00000000.2642443538.0000000140156000.00000002.00000001.01000000.00000015.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site/5LocalCtrl_alpha_v3.exe, 0000000C.00000003.2676035510.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site/uLocalCtrl_alpha_v3.exe, 0000000C.00000003.2670039373.0000000000523000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site:443LocalCtrl_alpha_v3.exe, 0000000C.00000003.2671497642.0000000000503000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2672784438.0000000000503000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site/2LocalCtrl_alpha_v3.exe, 00000010.00000002.2794479284.000000000046A000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://tataragirld.site/9LocalCtrl_alpha_v3.exe, 0000000C.00000003.2680648206.000000000051D000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2682419808.000000000051D000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.softwareok.comAdobeSync.exe, 00000003.00000002.2211313464.0000000007DEB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2269757895.00000000088A9000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2578201689.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2558452445.00000000080D8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2696919914.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.2686003244.00000000027D5000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000D.00000002.2685842972.0000000004C85000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://appsyndication.org/2006/appsyn8Rmoal0v85.exefalse
                            		high
                            https://tataragirld.site/vLocalCtrl_alpha_v3.exe, 00000010.00000003.2788438288.000000000046A000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown

                            World Map of Contacted IPs

                            ⊘No contacted IP infos

                            General Information

                            Joe Sandbox version:42.0.0 Malachite
                            Analysis ID:1586710
                            Start date and time:2025-01-09 14:40:08 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 9m 58s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:17
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:8Rmoal0v85.exe
                            renamed because original name is a hash value
                            Original Sample Name:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20.exe
                            Detection:MAL
                            Classification:mal84.evad.winEXE@18/26@2/0
                            EGA Information:
                            • Successful, ratio: 50%
                            HCA Information:
                            • Successful, ratio: 99%
                            • Number of executed functions: 112
                            • Number of non-executed functions: 277
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
                            • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Execution Graph export aborted for target AdobeSync.exe, PID 1588 because there are no executed function
                            • Execution Graph export aborted for target AdobeSync.exe, PID 5376 because there are no executed function
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing disassembly code.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: 8Rmoal0v85.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            08:41:06API Interceptor1x Sleep call for process: 8Rmoal0v85.exe modified
                            08:41:46API Interceptor41x Sleep call for process: LocalCtrl_alpha_v3.exe modified
                            08:41:49API Interceptor2x Sleep call for process: cmd.exe modified
                            14:41:28AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helpmonitorv3.lnk

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeLVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                              w3245.exeGet hashmaliciousUnknownBrowse
                                w3245.exeGet hashmaliciousUnknownBrowse
                                  9mauyKC3JW.exeGet hashmaliciousUnknownBrowse
                                    ATLEQQXO.exeGet hashmaliciousUnknownBrowse
                                      ATLEQQXO.exeGet hashmaliciousUnknownBrowse
                                        upgrade.htaGet hashmaliciousDarkVision RatBrowse
                                          MiJZ3z4t5K.exeGet hashmaliciousUnknownBrowse
                                            UolJwovI8c.exeGet hashmaliciousUnknownBrowse
                                              ONHQNHFT.msiGet hashmaliciousUnknownBrowse

                                                Created / dropped Files

                                                C:\Users\user\AppData\Local\Temp\498c6de

                                                Download File
                                                Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):5661033
                                                Entropy (8bit):7.736091700365314
                                                Encrypted:false
                                                SSDEEP:98304:cVZkFxhYvB46Y17CH+ZdKH1Qew2bVstq4cgeyv9Lt+QZWAZfzLP:cQM46O7RdKH2ew60R5x+wWgfvP
                                                MD5:C5CA1DCE471BB292DE2DECCDE432C3A0
                                                SHA1:A4B98EC34BE4C3D18E7FAF0DFD31C648430ACB8E
                                                SHA-256:08984DC5927E2285482A0990372F99912D319F5FFD27235C87BB892E8C834DC0
                                                SHA-512:9B60CBAB1AF7D4CC803AED8E06D94471385EB6E7CECAF0F5FD153ED4F5FE62E52DECD95AEFE5E987750DA31B000FA11E35D6D315632FE66674482031C6000EF1
                                                Malicious:false
                                                Preview:$2..&2..'2..'2..&2...2..32..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2...s..cs...n..D@..HT..p[..HE..tF..S...IG..U]..F_..tF..SG.'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..d]..NF..K[..bJ..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..d]..BS..n\..F\..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2...e..c{.{...U]..AF..bf..US..P]..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..Q...........'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..

                                                C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

                                                Download File
                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                Category:dropped
                                                Size (bytes):2364728
                                                Entropy (8bit):6.606009669324617
                                                Encrypted:false
                                                SSDEEP:49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
                                                MD5:967F4470627F823F4D7981E511C9824F
                                                SHA1:416501B096DF80DDC49F4144C3832CF2CADB9CB2
                                                SHA-256:B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
                                                SHA-512:8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Joe Sandbox View:
                                                • Filename: LVkAi4PBv6.exe, Detection: malicious, Browse
                                                • Filename: w3245.exe, Detection: malicious, Browse
                                                • Filename: w3245.exe, Detection: malicious, Browse
                                                • Filename: 9mauyKC3JW.exe, Detection: malicious, Browse
                                                • Filename: ATLEQQXO.exe, Detection: malicious, Browse
                                                • Filename: ATLEQQXO.exe, Detection: malicious, Browse
                                                • Filename: upgrade.hta, Detection: malicious, Browse
                                                • Filename: MiJZ3z4t5K.exe, Detection: malicious, Browse
                                                • Filename: UolJwovI8c.exe, Detection: malicious, Browse
                                                • Filename: ONHQNHFT.msi, Detection: malicious, Browse
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Local\Temp\Scabbard_20250109084106.log

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:ASCII text, with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):984
                                                Entropy (8bit):5.322773678370765
                                                Encrypted:false
                                                SSDEEP:24:YBE6bAIeLLzi6BE2k3QMBE1gcP2N/BE1gcP2JrBqcP2RaDXBqcP2EBqcP2W:eEMxYiAEzpE13gE13UVb1VJV1
                                                MD5:17D72C245EA21C8379BB308C4E7E4055
                                                SHA1:198394A8B14D941E58CC179C00728787BF619171
                                                SHA-256:272A93912F2601B59FA76BB41468D307E02209B5BF43DD48A5AB75AD399AA7DB
                                                SHA-512:6770153DD12AD5187E4D720B5726F848CCAD2E2AAE5DDD9C25561BDF6649DBC4D2B593935735FB8C1CD567D48999F4AAD7F9C404B9E8441895318AE1568DBAFB
                                                Malicious:false
                                                Preview:[140C:0C50][2025-01-09T08:41:05]i001: Burn v3.11.1.2318, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe..[140C:0C50][2025-01-09T08:41:05]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\8Rmoal0v85.exe -burn.filehandle.attached=520 -burn.filehandle.self=512'..[140C:0C50][2025-01-09T08:41:05]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\8Rmoal0v85.exe'..[140C:0C50][2025-01-09T08:41:05]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[140C:0C50][2025-01-09T08:41:06]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\Scabbard_20250109084106.log'..[140C:0C50][2025-01-09T08:41:06]i000: Setting string variable 'WixBundleName' to value 'Scabbard'..[140C:0C50][2025-01-09T08:41:06]i000: Setting string variable 'WixBundleManufacturer' to value 'Ravine'..

                                                C:\Users\user\AppData\Local\Temp\bgjyfakxi

                                                Download File
                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                Category:dropped
                                                Size (bytes):2564608
                                                Entropy (8bit):6.715211244010203
                                                Encrypted:false
                                                SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                • Antivirus: ReversingLabs, Detection: 24%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                C:\Users\user\AppData\Local\Temp\f369682d

                                                Download File
                                                Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):5661033
                                                Entropy (8bit):7.736092018620271
                                                Encrypted:false
                                                SSDEEP:98304:nVZkFxhYvB46Y17CH+ZdKH1Qew2bVstq4cgeyv9Lt+QZWAZfzLP:nQM46O7RdKH2ew60R5x+wWgfvP
                                                MD5:21ED2C740FC7D18335F9AE486737DE86
                                                SHA1:CC50D2B8752FAEFBD30E01F007A135A8A35FA5AE
                                                SHA-256:1650E3B4D171F605C26AAB69A68EE7BF047969C1B8CFAC490BC95744BB48BBCD
                                                SHA-512:9C48A80538DFB0EF08B66D91F4558FBCC0DB0C58F649C5C5F1732143EA613615337A20718B1FEEB6A3F992D2B6E51D8C47577CB41E8BA12F0D880B962EC69389
                                                Malicious:false
                                                Preview:$2..&2..'2..'2..&2...2..32..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2...s..cs...n..D@..HT..p[..HE..tF..S...IG..U]..F_..tF..SG.'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..d]..NF..K[..bJ..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..d]..BS..n\..F\..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2...e..c{.{...U]..AF..bf..US..P]..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..Q...........'2..'2..'2..'2..'2..'2..'2..'2..'2..'2..

                                                C:\Users\user\AppData\Local\Temp\idsvevgmlxihl

                                                Download File
                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                Category:dropped
                                                Size (bytes):2564608
                                                Entropy (8bit):6.715211244010203
                                                Encrypted:false
                                                SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                • Antivirus: ReversingLabs, Detection: 24%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                C:\Users\user\AppData\Local\Temp\rqgcqbnwl

                                                Download File
                                                Process:C:\Windows\SysWOW64\cmd.exe
                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 9 12:41:07 2025, mtime=Thu Jan 9 12:41:08 2025, atime=Fri Jan 3 12:50:46 2025, length=1219488, window=hide
                                                Category:dropped
                                                Size (bytes):924
                                                Entropy (8bit):5.043024589352187
                                                Encrypted:false
                                                SSDEEP:24:8yOhcD4lXU0S+acHAeYRqsWUAt1yUgHAeYabclom:85mD4lG3SAeqqsWjXmAeClo
                                                MD5:CDDEE93ED19DC6BD8A1CDF06F945F8C7
                                                SHA1:EA4EB7C688C917C37C5DEFC349D68272A0D1AF4D
                                                SHA-256:E0E26DC054648BBBC19E29755F0B4ED6B9732D71BA0B6556903B0688A769609A
                                                SHA-512:12F63F5B55AF4543FC0B98E595246E9C5A8A8D4A23BE92E285C849C8D25FCC635F1FCB2E0DFC0799FA723D63E94A0D7825D720315E4C0E10E65B89B99A26768B
                                                Malicious:false
                                                Preview:L..................F.... ......".b..w..#.b.....}.]............................:..DG..Yr?.D..U..k0.&...&.......$..S...l....b....8).b......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2)Z"m...........................^.A.p.p.D.a.t.a...B.V.1.....)Z$m..Roaming.@......EW<2)Z%m..../.......................0.R.o.a.m.i.n.g.....f.1.....)Z$m..PATCHR~1..N......)Z$m)Z%m..........................2...P.a.t.c.h.R.e.a.d.e.r.W.C.F.....h.2.....#ZWn .ADOBES~1.EXE..L......)Z$m)Z$m..............................A.d.o.b.e.S.y.n.c...e.x.e.......m...............-.......l............6.u.....C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe..*.....\.....\.R.o.a.m.i.n.g.\.P.a.t.c.h.R.e.a.d.e.r.W.C.F.\.A.d.o.b.e.S.y.n.c...e.x.e.`.......X.......965969...........hT..CrF.f4... .-...Jc...-...-$..hT..CrF.f4... .-...Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):168960
                                                Entropy (8bit):6.635989544957891
                                                Encrypted:false
                                                SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                MD5:77610CBDCAC173785E2FB18CCB522574
                                                SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 30%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):1219488
                                                Entropy (8bit):6.312582930861741
                                                Encrypted:false
                                                SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):110472
                                                Entropy (8bit):6.411600464209584
                                                Encrypted:false
                                                SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\choirgirl.pdf

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):62969
                                                Entropy (8bit):4.539146899101455
                                                Encrypted:false
                                                SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                Malicious:false
                                                Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\intermixture.zip

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):4526833
                                                Entropy (8bit):7.959653744732072
                                                Encrypted:false
                                                SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                MD5:3085505DB1512B966530B829E136BDCF
                                                SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                Malicious:false
                                                Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):570496
                                                Entropy (8bit):6.5259314477231305
                                                Encrypted:false
                                                SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):653952
                                                Entropy (8bit):6.885961951552677
                                                Encrypted:false
                                                SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                MD5:11D49148A302DE4104DED6A92B78B0ED
                                                SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll

                                                Download File
                                                Process:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):249232
                                                Entropy (8bit):6.822042592978165
                                                Encrypted:false
                                                SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe

                                                Download File
                                                Process:C:\Users\user\Desktop\8Rmoal0v85.exe
                                                File Type:Unknown
                                                Category:dropped
                                                Size (bytes):6305325
                                                Entropy (8bit):7.9787714785946955
                                                Encrypted:false
                                                SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
                                                MD5:9C540950F5A8981844FF33BFC55D2F36
                                                SHA1:8C70F2BCB995CE313843CF7103C659C12EB263DC
                                                SHA-256:DD53AC67D905DEFD4BD1F2B9B413DFC679E7C076E92792BE650C38659E1557C5
                                                SHA-512:7D87E02B60647134758F4C20BDB18A1DEF78BC9B69D337B6EE6D9B190968749D028479D0F6758CDFD8C76DF454F7AE68395A4EBDCB6D99CEA5B0B48CD5BA685B
                                                Malicious:true
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z..........................................@.......................................@..................................................................`...=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=...`...>..."..............@..B................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AXE8SharedExpat.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):168960
                                                Entropy (8bit):6.635989544957891
                                                Encrypted:false
                                                SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                MD5:77610CBDCAC173785E2FB18CCB522574
                                                SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 30%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):1219488
                                                Entropy (8bit):6.312582930861741
                                                Encrypted:false
                                                SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\BIB.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):110472
                                                Entropy (8bit):6.411600464209584
                                                Encrypted:false
                                                SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\BootstrapperApplicationData.xml

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (473), with CRLF line terminators
                                                Category:dropped
                                                Size (bytes):2006
                                                Entropy (8bit):3.7572989677816073
                                                Encrypted:false
                                                SSDEEP:48:y+03qHhhO7YDTT3ne1REDHV5JC0wNqycUbTXRC+bLqihGrWrol:Xn7n6q80wMycsRCDKGrN
                                                MD5:ADBA259B1418C9ED84277688BFEEFAA7
                                                SHA1:A6EF522036403047FF578DEF1E0AFD616A277357
                                                SHA-256:6DF90329C4E3DF98DBB91556C98CDB46CD0258B49A500999284096A9DF972BDA
                                                SHA-512:9F90BD3C1892CE45870DE3FEC0F83516E5B61C1774024C03EC2BCDAEB7C8AC1F05536BF0403C77F520D8D39C0ACBE11769A32A3FE49571B71F1D4DCC5FCFFE66
                                                Malicious:false
                                                Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".S.c.a.b.b.a.r.d.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.5.c.6.7.9.b.6.d.-.9.8.d.4.-.4.b.7.8.-.9.6.0.a.-.1.8.2.1.c.9.2.2.7.4.d.b.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.6.C.D.E.7.8.E.C.-.4.C.1.C.-.4.6.A.B.-.B.B.E.9.-.9.7.4.6.B.E.0.D.7.F.8.6.}.". .P.e.r.M.a.c.h.i.n.e.=.".n.o.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".S.l.u.i.t.". .V.i.t.a.l.=.".y.e.s.". .D.i.s.p.l.a.y.N.a.m.e.=.".P.y.t.h.o.n. .3...1.2...5. .E.x.e.c.u.t.a.b.l.e.s. .(.6.4.-.b.i.t.).". .D.o.w.n.l.o.a.d.S.i.z.e.=.".7.4.1.3.7.6.". .P.a.c.k.a.g.e.S.i.z.e.=.".7.4.1.3.7.6.".

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\Quadruple.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):255392
                                                Entropy (8bit):6.5751135995470245
                                                Encrypted:false
                                                SSDEEP:6144:z7qdWWmoR0sztnfGIUbmUL1ueM+d9euhAOZD3FCP3z:Sssztnfu9ueM+doKX4P3z
                                                MD5:7C95B91566BA5A2D8BF70C2BCF13D712
                                                SHA1:B01F54AE2964480B8AEB2817285219AB8A2C79C0
                                                SHA-256:39230D24CF7602FF2B00A7FF13BA5160B9B3446FBA7C6F6295DD4FB2EB408DF5
                                                SHA-512:AB70A77C05EC42B77166D2E7FC81B18AD390E2CB32249F35355AFD4271AEDCFBDE882992AE0E84A9F95453CB9FD05AE224713EE3FDA93BABC6C9CFB572B50FAD
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.o.1.o.1.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1.o.1.o.1...0.o.1...0.o.1..W1.o.1.o?1.o.1...0.o.1Rich.o.1................PE..L...C.3`.........."!.........R......................................................~.....@......................... .......,...x.......p........................(...`..p...................@a......p...@...................<...@....................text............................... ..`.rdata..N...........................@..@.data...............................@....rsrc...p...........................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\choirgirl.pdf

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):62969
                                                Entropy (8bit):4.539146899101455
                                                Encrypted:false
                                                SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                Malicious:false
                                                Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\intermixture.zip

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):4526833
                                                Entropy (8bit):7.959653744732072
                                                Encrypted:false
                                                SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                MD5:3085505DB1512B966530B829E136BDCF
                                                SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                Malicious:false
                                                Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcp90.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):570496
                                                Entropy (8bit):6.5259314477231305
                                                Encrypted:false
                                                SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\msvcr90.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):653952
                                                Entropy (8bit):6.885961951552677
                                                Encrypted:false
                                                SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                MD5:11D49148A302DE4104DED6A92B78B0ED
                                                SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                Malicious:false
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\sqlite.dll

                                                Download File
                                                Process:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                Category:dropped
                                                Size (bytes):249232
                                                Entropy (8bit):6.822042592978165
                                                Encrypted:false
                                                SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                Malicious:true
                                                Antivirus:
                                                • Antivirus: ReversingLabs, Detection: 0%
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                Static File Info

                                                General

                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                Entropy (8bit):7.982299622775732
                                                TrID:
                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                • DOS Executable Generic (2002/1) 0.02%
                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                File name:8Rmoal0v85.exe
                                                File size:7'012'352 bytes
                                                MD5:9c4e46ef2e0ad08e7040de7b3c1e60e7
                                                SHA1:72d4a6613e520cb8b39e1ac4b347270cc1450fff
                                                SHA256:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20
                                                SHA512:88022929c133246f0bd5178083abd31d006077897822bfb7d9f2dc20de88523d914740dff03a29935c6a55901a03aa29cb04fab82d425c5cf73c001f11b28e99
                                                SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvgEh7:r58jucejnmkVY4zoZ5Qrh7
                                                TLSH:CC662332A4614033D7F201B3AD6892347EBCEF28175099A9E3D4BD5D6EF44922BB7253
                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@.......@......y@.......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@.

                                                File Icon

                                                Icon Hash:a9e8e8e9e8e8e8a9

                                                Static PE Info

                                                General

                                                Entrypoint:0x42e2a6
                                                Entrypoint Section:.text
                                                Digitally signed:false
                                                Imagebase:0x400000
                                                Subsystem:windows gui
                                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
                                                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                Time Stamp:0x5A10AD86 [Sat Nov 18 22:00:38 2017 UTC]
                                                TLS Callbacks:
                                                CLR (.Net) Version:
                                                OS Version Major:5
                                                OS Version Minor:1
                                                File Version Major:5
                                                File Version Minor:1
                                                Subsystem Version Major:5
                                                Subsystem Version Minor:1
                                                Import Hash:d7e2fd259780271687ffca462b9e69b7

                                                Entrypoint Preview

                                                Instruction
                                                call 00007F683CDC4E9Fh
                                                jmp 00007F683CDC4813h
                                                mov eax, dword ptr [esp+08h]
                                                mov ecx, dword ptr [esp+10h]
                                                or ecx, eax
                                                mov ecx, dword ptr [esp+0Ch]
                                                jne 00007F683CDC498Bh
                                                mov eax, dword ptr [esp+04h]
                                                mul ecx
                                                retn 0010h
                                                push ebx
                                                mul ecx
                                                mov ebx, eax
                                                mov eax, dword ptr [esp+08h]
                                                mul dword ptr [esp+14h]
                                                add ebx, eax
                                                mov eax, dword ptr [esp+08h]
                                                mul ecx
                                                add edx, ebx
                                                pop ebx
                                                retn 0010h
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                cmp cl, 00000040h
                                                jnc 00007F683CDC4997h
                                                cmp cl, 00000020h
                                                jnc 00007F683CDC4988h
                                                shrd eax, edx, cl
                                                shr edx, cl
                                                ret
                                                mov eax, edx
                                                xor edx, edx
                                                and cl, 0000001Fh
                                                shr eax, cl
                                                ret
                                                xor eax, eax
                                                xor edx, edx
                                                ret
                                                push ebp
                                                mov ebp, esp
                                                jmp 00007F683CDC498Fh
                                                push dword ptr [ebp+08h]
                                                call 00007F683CDCB20Ch
                                                pop ecx
                                                test eax, eax
                                                je 00007F683CDC4991h
                                                push dword ptr [ebp+08h]
                                                call 00007F683CDCB295h
                                                pop ecx
                                                test eax, eax
                                                je 00007F683CDC4968h
                                                pop ebp
                                                ret
                                                cmp dword ptr [ebp+08h], FFFFFFFFh
                                                je 00007F683CDC5224h
                                                jmp 00007F683CDC5201h
                                                push ebp
                                                mov ebp, esp
                                                push dword ptr [ebp+08h]
                                                call 00007F683CDC523Dh
                                                pop ecx
                                                pop ebp
                                                ret
                                                push ebp
                                                mov ebp, esp
                                                test byte ptr [ebp+08h], 00000001h
                                                push esi
                                                mov esi, ecx
                                                mov dword ptr [esi], 00460DB8h
                                                je 00007F683CDC498Ch
                                                push 0000000Ch
                                                push esi
                                                call 00007F683CDC495Dh
                                                pop ecx
                                                pop ecx
                                                mov eax, esi
                                                pop esi
                                                pop ebp

                                                Rich Headers

                                                Programming Language:
                                                • [ C ] VS2008 SP1 build 30729
                                                • [IMP] VS2008 SP1 build 30729

                                                Data Directories

                                                NameVirtual AddressVirtual Size Is in Section
                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x686b40xb4.rdata
                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x6d0000x189ac.rsrc
                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x860000x3dfc.reloc
                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x676500x54.rdata
                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_TLS0x676a40x18.rdata
                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x670300x40.rdata
                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IAT0x4b0000x3e0.rdata
                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x682340x100.rdata
                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                Sections

                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                .text0x10000x499370x49a002319c0baa707bb66cc0bc08c55a13d8cFalse0.5314688561120543data6.570006046413636IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                .rdata0x4b0000x1ed600x1ee008ad6c4e18165c6d8ccdc97bab683438dFalse0.3136386639676113data5.114228301263695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .data0x6a0000x17300xa0000fde973df27dc2d36084e16d6dddbdfFalse0.274609375firmware 2005 v9319 (revision 0) N\346@\273\261\031\277D V2, 0 bytes or less, UNKNOWN2 0xffffffff, at 0 0 bytes , at 0 0 bytes , at 0x20a146003.1526594027632213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .wixburn0x6c0000x380x2006a6fa226648aa5455d00e43308ab550fFalse0.107421875data0.5813091016060967IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .rsrc0x6d0000x189ac0x18a00768107f716c3d4350e9c7978a9a75946False0.6123790450507615data7.16247135144247IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .reloc0x860000x3dfc0x3e00dd2c47fa48872886af4c9a2e5bd90cccFalse0.8097278225806451data6.794335469567533IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                Resources

                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                RT_ICON0x6d2c80xaf05PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.00046869768999
                                                RT_ICON0x781d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 0EnglishUnited States0.2670642418516769
                                                RT_ICON0x7c3f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.3201244813278008
                                                RT_ICON0x7e9a00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 0EnglishUnited States0.3479289940828402
                                                RT_ICON0x804080x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3897748592870544
                                                RT_ICON0x814b00x988Device independent bitmap graphic, 24 x 48 x 32, image size 0EnglishUnited States0.4389344262295082
                                                RT_ICON0x81e380x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 0EnglishUnited States0.45290697674418606
                                                RT_ICON0x824f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.6338652482269503
                                                RT_MESSAGETABLE0x829580x2840dataEnglishUnited States0.28823757763975155
                                                RT_GROUP_ICON0x851980x76dataEnglishUnited States0.7203389830508474
                                                RT_VERSION0x852100x2c8dataEnglishUnited States0.47752808988764045
                                                RT_MANIFEST0x854d80x4d2XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminatorsEnglishUnited States0.47568881685575365

                                                Imports

                                                DLLImport
                                                ADVAPI32.dllRegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DecryptFileW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
                                                USER32.dllPeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
                                                OLEAUT32.dllVariantInit, SysAllocString, VariantClear, SysFreeString
                                                GDI32.dllDeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
                                                SHELL32.dllCommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
                                                ole32.dllCoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
                                                KERNEL32.dllGetCommandLineA, GetCPInfo, GetOEMCP, CloseHandle, CreateFileW, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, FindClose, GetCommandLineW, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, GetCurrentProcess, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, FreeLibrary, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetNativeSystemInfo, GetModuleHandleExW, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetEnvironmentStringsW, VerifyVersionInfoW, GetVolumePathNameW, GetDateFormatW, GetUserDefaultUILanguage, GetSystemDefaultLangID, GetUserDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, InterlockedExchange, InterlockedCompareExchange, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, OpenProcess, GetProcessId, WaitForSingleObject, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, InterlockedIncrement, InterlockedDecrement, ResetEvent, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, CreateFileMappingW, GetThreadLocale, IsValidCodePage, FindFirstFileExW, FreeEnvironmentStringsW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DecodePointer, WriteConsoleW, GetModuleHandleA, GlobalAlloc, GlobalFree, GetFileSizeEx, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetComputerNameW, SetCurrentDirectoryW, GetFileType, GetACP, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, LoadLibraryExA
                                                RPCRT4.dllUuidCreate

                                                Possible Origin

                                                Language of compilation systemCountry where language is spokenMap
                                                EnglishUnited States

                                                Network Behavior

                                                Network Port Distribution

                                                UDP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Jan 9, 2025 14:41:55.030625105 CET6118253192.168.2.61.1.1.1
                                                Jan 9, 2025 14:41:55.040118933 CET53611821.1.1.1192.168.2.6
                                                Jan 9, 2025 14:42:05.931422949 CET5681353192.168.2.61.1.1.1
                                                Jan 9, 2025 14:42:05.940232038 CET53568131.1.1.1192.168.2.6

                                                DNS Queries

                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Jan 9, 2025 14:41:55.030625105 CET192.168.2.61.1.1.10xe4f8Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                Jan 9, 2025 14:42:05.931422949 CET192.168.2.61.1.1.10x8439Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false

                                                DNS Answers

                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Jan 9, 2025 14:41:55.040118933 CET1.1.1.1192.168.2.60xe4f8Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                Jan 9, 2025 14:42:05.940232038 CET1.1.1.1192.168.2.60x8439Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false

                                                Statistics

                                                CPU Usage

                                                Click to jump to process

                                                Memory Usage

                                                Click to jump to process

                                                High Level Behavior Distribution

                                                Click to dive into process behavior distribution

                                                Behavior

                                                Click to jump to process

                                                System Behavior

                                                General

                                                Target ID:0
                                                Start time:08:41:05
                                                Start date:09/01/2025
                                                Path:C:\Users\user\Desktop\8Rmoal0v85.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\8Rmoal0v85.exe"
                                                Imagebase:0xa80000
                                                File size:7'012'352 bytes
                                                MD5 hash:9C4E46EF2E0AD08E7040DE7B3C1E60E7
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:2
                                                Start time:08:41:05
                                                Start date:09/01/2025
                                                Path:C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=520 -burn.filehandle.self=512
                                                Imagebase:0x5d0000
                                                File size:6'305'325 bytes
                                                MD5 hash:9C540950F5A8981844FF33BFC55D2F36
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:3
                                                Start time:08:41:06
                                                Start date:09/01/2025
                                                Path:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                Wow64 process (32bit):true
                                                Commandline:C:\Windows\Temp\{A0AE912D-C1AC-44CB-9047-290EF1DFDBB5}\.ba\AdobeSync.exe
                                                Imagebase:0x450000
                                                File size:1'219'488 bytes
                                                MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Antivirus matches:
                                                • Detection: 0%, ReversingLabs
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:4
                                                Start time:08:41:08
                                                Start date:09/01/2025
                                                Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                Wow64 process (32bit):true
                                                Commandline:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                Imagebase:0xf90000
                                                File size:1'219'488 bytes
                                                MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Antivirus matches:
                                                • Detection: 0%, ReversingLabs
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:5
                                                Start time:08:41:08
                                                Start date:09/01/2025
                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                Wow64 process (32bit):true
                                                Commandline:C:\Windows\SysWOW64\cmd.exe
                                                Imagebase:0x1c0000
                                                File size:236'544 bytes
                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:6
                                                Start time:08:41:08
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\conhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                Imagebase:0x7ff66e660000
                                                File size:862'208 bytes
                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:11
                                                Start time:08:41:36
                                                Start date:09/01/2025
                                                Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
                                                Imagebase:0xf90000
                                                File size:1'219'488 bytes
                                                MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:12
                                                Start time:08:41:37
                                                Start date:09/01/2025
                                                Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                Imagebase:0x140000000
                                                File size:2'364'728 bytes
                                                MD5 hash:967F4470627F823F4D7981E511C9824F
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Antivirus matches:
                                                • Detection: 0%, ReversingLabs
                                                Reputation:moderate
                                                Has exited:true

                                                General

                                                Target ID:13
                                                Start time:08:41:37
                                                Start date:09/01/2025
                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                Wow64 process (32bit):true
                                                Commandline:C:\Windows\SysWOW64\cmd.exe
                                                Imagebase:0x1c0000
                                                File size:236'544 bytes
                                                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:14
                                                Start time:08:41:37
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\conhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                Imagebase:0x7ff66e660000
                                                File size:862'208 bytes
                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:16
                                                Start time:08:41:51
                                                Start date:09/01/2025
                                                Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                Imagebase:0x140000000
                                                File size:2'364'728 bytes
                                                MD5 hash:967F4470627F823F4D7981E511C9824F
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:true

                                                Disassembly

                                                Reset < >

                                                  Executed Functions

                                                  Function 00A83CC4 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 320fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 482 a83cc4-a83d51 call aaf8e0 * 2 GetFileAttributesW 487 a83d53-a83d5a GetLastError 482->487 488 a83d85-a83d88 482->488 489 a83d5c-a83d5e 487->489 490 a83d5f-a83d61 487->490 491 a83d8e-a83d91 488->491 492 a840d5 488->492 489->490 493 a83d6e 490->493 494 a83d63-a83d6c 490->494 496 a83dca-a83dd1 491->496 497 a83d93-a83da6 SetFileAttributesW 491->497 495 a840da-a840e3 492->495 493->488 500 a83d70-a83d71 493->500 494->493 501 a840ec-a840f3 495->501 502 a840e5-a840e6 FindClose 495->502 498 a83de0-a83de8 496->498 499 a83dd3-a83dda 496->499 497->496 503 a83da8-a83dae GetLastError 497->503 505 a83dea-a83dfe 498->505 506 a83e25-a83e40 call a82d58 498->506 499->498 504 a84058 499->504 507 a83d76-a83d80 call a83821 500->507 508 a84100-a84112 call aae06f 501->508 509 a840f5-a840fb call ac5636 501->509 502->501 510 a83dbb 503->510 511 a83db0-a83db9 503->511 514 a8405e-a8406c RemoveDirectoryW 504->514 505->506 525 a83e00-a83e06 GetLastError 505->525 506->501 524 a83e46-a83e62 FindFirstFileW 506->524 507->501 509->508 512 a83dbd 510->512 513 a83dc2-a83dc8 510->513 511->510 512->513 513->507 514->495 521 a8406e-a84074 GetLastError 514->521 526 a8407f-a84085 521->526 527 a84076-a84079 521->527 528 a83e89-a83e93 524->528 529 a83e64-a83e6a GetLastError 524->529 530 a83e08-a83e11 525->530 531 a83e13 525->531 532 a840a1-a840a3 526->532 533 a84087-a84089 526->533 527->526 537 a83eba-a83ee0 call a82d58 528->537 538 a83e95-a83e9e 528->538 535 a83e6c-a83e75 529->535 536 a83e77 529->536 530->531 539 a83e1a-a83e20 531->539 540 a83e15 531->540 532->495 534 a840a5-a840ab 532->534 533->534 541 a8408b-a8409d MoveFileExW 533->541 542 a83ffa-a84004 call a83821 534->542 535->536 543 a83e79 536->543 544 a83e7e-a83e7f 536->544 537->495 557 a83ee6-a83ef3 537->557 545 a83fbd-a83fcd FindNextFileW 538->545 546 a83ea4-a83eab 538->546 539->507 540->539 541->534 548 a8409f 541->548 542->495 543->544 544->528 549 a8404d-a84052 GetLastError 545->549 550 a83fcf-a83fd5 545->550 546->537 552 a83ead-a83eb4 546->552 548->532 554 a840b0-a840b6 GetLastError 549->554 555 a84054-a84056 549->555 550->528 552->537 552->545 560 a840b8-a840c1 554->560 561 a840c3 554->561 555->514 558 a83f22-a83f29 557->558 559 a83ef5-a83ef7 557->559 565 a83f2f-a83f31 558->565 566 a83fb7 558->566 559->558 562 a83ef9-a83f09 call a82b0c 559->562 560->561 563 a840ca-a840d0 561->563 564 a840c5 561->564 562->495 573 a83f0f-a83f18 call a83cc4 562->573 563->542 564->563 568 a83f4c-a83f5a DeleteFileW 565->568 569 a83f33-a83f46 SetFileAttributesW 565->569 566->545 568->566 572 a83f5c-a83f5e 568->572 569->568 571 a83fda-a83fe0 GetLastError 569->571 574 a83fed 571->574 575 a83fe2-a83feb 571->575 576 a8402b-a84031 GetLastError 572->576 577 a83f64-a83f81 GetTempFileNameW 572->577 587 a83f1d 573->587 581 a83fef 574->581 582 a83ff4-a83ff5 574->582 575->574 578 a8403e 576->578 579 a84033-a8403c 576->579 583 a84009-a8400f GetLastError 577->583 584 a83f87-a83fa4 MoveFileExW 577->584 585 a84040 578->585 586 a84045-a8404b 578->586 579->578 581->582 582->542 588 a8401c 583->588 589 a84011-a8401a 583->589 590 a83faf 584->590 591 a83fa6-a83fad 584->591 585->586 586->542 587->566 593 a8401e 588->593 594 a84023-a84029 588->594 589->588 592 a83fb5 MoveFileExW 590->592 591->592 592->566 593->594 594->542
                                                  APIs
                                                  • GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00A83D40
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83D53
                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00A83D9E
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83DA8
                                                  • GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00A83DF6
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83E00
                                                  • FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00A83E53
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83E64
                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00A83F3E
                                                  • DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00A83F52
                                                  • GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00A83F79
                                                  • MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00A83F9C
                                                  • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00A83FB5
                                                  • FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00A83FC5
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83FDA
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A84009
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A8402B
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A8404D
                                                  • RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00A84064
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A8406E
                                                  • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00A84095
                                                  • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A840B0
                                                  • FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00A840E6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
                                                  • String ID: 4#v$*.*$DEL$dirutil.cpp
                                                  • API String ID: 1544372074-4118715877
                                                  • Opcode ID: 4d52183f010a2d2183157b61d2a0edff075034608fa0c037539b5a969144dcd1
                                                  • Instruction ID: e605cdb85260c32e63fd122fe7ba386ba83fa789ded2f3031b90130ca0a67471
                                                  • Opcode Fuzzy Hash: 4d52183f010a2d2183157b61d2a0edff075034608fa0c037539b5a969144dcd1
                                                  • Instruction Fuzzy Hash: 56B1E973D012399BDF30BB648D05BAAB675AF44B10F024295EE08BB190D7769E90CBE0
                                                  Function 00A85195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 595 a85195-a85243 call aaf8e0 * 2 GetModuleHandleW call ac04f8 call ac06ae call a8120a 606 a85259-a8526a call a842d7 595->606 607 a85245 595->607 612 a8526c-a85271 606->612 613 a85273-a8528f call a85618 CoInitializeEx 606->613 608 a8524a-a85254 call ac0237 607->608 616 a854d4-a854db 608->616 612->608 623 a85298-a852a4 call abfcae 613->623 624 a85291-a85296 613->624 618 a854e8-a854ea 616->618 619 a854dd-a854e3 call ac5636 616->619 621 a854fa-a85518 call a8d82f call a9a8d6 call a9ab24 618->621 622 a854ec-a854f3 618->622 619->618 645 a8551a-a85522 621->645 646 a85546-a85559 call a84fa4 621->646 622->621 625 a854f5 call a941ec 622->625 632 a852b8-a852c7 call ac0e07 623->632 633 a852a6 623->633 624->608 625->621 642 a852c9-a852ce 632->642 643 a852d0-a852df call ac2af7 632->643 635 a852ab-a852b3 call ac0237 633->635 635->616 642->635 650 a852e8-a852f7 call ac3565 643->650 651 a852e1-a852e6 643->651 645->646 649 a85524-a85527 645->649 655 a8555b call ac3a35 646->655 656 a85560-a85567 646->656 649->646 653 a85529-a85544 call a9434c call a85602 649->653 664 a852f9-a852fe 650->664 665 a85300-a8531f GetVersionExW 650->665 651->635 653->646 655->656 661 a85569 call ac2efe 656->661 662 a8556e-a85575 656->662 661->662 667 a8557c-a85583 662->667 668 a85577 call ac1479 662->668 664->635 670 a85359-a8539e call a833c7 call a85602 665->670 671 a85321-a8532b GetLastError 665->671 673 a8558a-a8558c 667->673 674 a85585 call abfdbd 667->674 668->667 697 a853a0-a853ab call ac5636 670->697 698 a853b1-a853c1 call a9752a 670->698 679 a85338 671->679 680 a8532d-a85336 671->680 677 a8558e CoUninitialize 673->677 678 a85594-a8559b 673->678 674->673 677->678 682 a8559d-a8559f 678->682 683 a855d6-a855df call ac0113 678->683 684 a8533a 679->684 685 a8533f-a85354 call a83821 679->685 680->679 688 a855a1-a855a3 682->688 689 a855a5-a855ab 682->689 695 a855e1 call a845ee 683->695 696 a855e6-a855ff call ac0802 call aae06f 683->696 684->685 685->635 693 a855ad-a855c6 call a93d85 call a85602 688->693 689->693 693->683 714 a855c8-a855d5 call a85602 693->714 695->696 697->698 710 a853cd-a853d6 698->710 711 a853c3 698->711 715 a853dc-a853df 710->715 716 a8549e-a854ab call a84d39 710->716 711->710 714->683 719 a853e5-a853e8 715->719 720 a85476-a85492 call a84ae5 715->720 724 a854b0-a854b4 716->724 721 a853ea-a853ed 719->721 722 a8544e-a8546a call a848ef 719->722 729 a854c0-a854d2 720->729 735 a85494 720->735 726 a853ef-a853f2 721->726 727 a85426-a85442 call a84a88 721->727 722->729 737 a8546c 722->737 724->729 730 a854b6 724->730 733 a85403-a85416 call a84c86 726->733 734 a853f4-a853f9 726->734 727->729 741 a85444 727->741 729->616 730->729 733->729 742 a8541c 733->742 734->733 735->716 737->720 741->722 742->727
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A85217
                                                    • Part of subcall function 00AC04F8: InitializeCriticalSection.KERNEL32(00AEB5FC,?,00A85223,00000000,?,?,?,?,?,?), ref: 00AC050F
                                                    • Part of subcall function 00A8120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00A8523F,00000000,?), ref: 00A81248
                                                    • Part of subcall function 00A8120A: GetLastError.KERNEL32(?,?,?,00A8523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00A81252
                                                  • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00A85285
                                                    • Part of subcall function 00AC0E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00AC0E28
                                                  • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00A85317
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00A85321
                                                  • CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A8558E
                                                  Strings
                                                  • Failed to initialize Regutil., xrefs: 00A852C9
                                                  • Failed to initialize Cryputil., xrefs: 00A852A6
                                                  • Failed to get OS info., xrefs: 00A8534F
                                                  • Failed to run per-user mode., xrefs: 00A85494
                                                  • Failed to initialize COM., xrefs: 00A85291
                                                  • user.cpp, xrefs: 00A85345
                                                  • 3.11.1.2318, xrefs: 00A85384
                                                  • Failed to initialize user state., xrefs: 00A8526C
                                                  • Failed to run untrusted mode., xrefs: 00A854B6
                                                  • Failed to run embedded mode., xrefs: 00A85444
                                                  • Failed to run RunOnce mode., xrefs: 00A8541C
                                                  • Invalid run mode., xrefs: 00A853F9
                                                  • Failed to run per-machine mode., xrefs: 00A8546C
                                                  • Failed to initialize core., xrefs: 00A853C3
                                                  • Failed to initialize Wiutil., xrefs: 00A852E1
                                                  • Failed to initialize XML util., xrefs: 00A852F9
                                                  • Failed to parse command line., xrefs: 00A85245
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                  • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$user.cpp
                                                  • API String ID: 3262001429-510904028
                                                  • Opcode ID: f614cfa02dae4df1659d5806d051c3f5f3a1807031827e8610d078fc9793a20b
                                                  • Instruction ID: fb3e4fe85dfc36a470d5f60623a7f52aa608ad4d15de422c4e1fdfac3fe48004
                                                  • Opcode Fuzzy Hash: f614cfa02dae4df1659d5806d051c3f5f3a1807031827e8610d078fc9793a20b
                                                  • Instruction Fuzzy Hash: DCB18272D40A29ABDB32BB74CD46FED76B9BF04710F450199ED08B6241EB719E80CB91
                                                  Function 00AC304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00AC3609,00000000,?,00000000), ref: 00AC3069
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00AAC025,?,00A85405,?,00000000,?), ref: 00AC3075
                                                  • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00AC30B5
                                                  • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AC30C1
                                                  • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00AC30CC
                                                  • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AC30D6
                                                  • CoCreateInstance.OLE32(00AEB6B8,00000000,00000001,00ACB818,?,?,?,?,?,?,?,?,?,?,?,00AAC025), ref: 00AC3111
                                                  • ExitProcess.KERNEL32 ref: 00AC31C0
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                  • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                  • API String ID: 2124981135-499589564
                                                  • Opcode ID: 66ffd94f1fe25207505ee85f212f3eaac67a0668a7491a13c6510d06fef1c4d6
                                                  • Instruction ID: ec80a6201f57977bb408e45fcb2286bc1dc699c9f0efbe0181d4835604df7fcd
                                                  • Opcode Fuzzy Hash: 66ffd94f1fe25207505ee85f212f3eaac67a0668a7491a13c6510d06fef1c4d6
                                                  • Instruction Fuzzy Hash: A841A033A01215AFDF25DBA9C845FAEB7B4AF44750F16856CE901EB240DB71DE418BA0
                                                  Function 00A81070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A833C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00A810DD,?,00000000), ref: 00A833E8
                                                  • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00A810F6
                                                    • Part of subcall function 00A81175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A81186
                                                    • Part of subcall function 00A81175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A81191
                                                    • Part of subcall function 00A81175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A8119F
                                                    • Part of subcall function 00A81175: GetLastError.KERNEL32(?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A811BA
                                                    • Part of subcall function 00A81175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A811C2
                                                    • Part of subcall function 00A81175: GetLastError.KERNEL32(?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A811D7
                                                  • CloseHandle.KERNELBASE(?,?,?,?,00ACB4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00A81131
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                  • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                  • API String ID: 3687706282-3151496603
                                                  • Opcode ID: 9021d399df544b7e8a5bc785c63bd12fe04ea7d1f902a4e7bec40cd9430d8cef
                                                  • Instruction ID: 3cf337650c587dc3ceaf6e0849b9386b8ec8af969de520d71547f9fca2067ad3
                                                  • Opcode Fuzzy Hash: 9021d399df544b7e8a5bc785c63bd12fe04ea7d1f902a4e7bec40cd9430d8cef
                                                  • Instruction Fuzzy Hash: 7E215E7191021CABDB10EFA4DD4AFDEBBB8AB05711F514219EA11B7281D77159058BB0
                                                  Function 00A9A0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to calculate working folder to ensure it exists., xrefs: 00A9A0D8
                                                  • Failed create working folder., xrefs: 00A9A0EE
                                                  • Failed to copy working folder., xrefs: 00A9A116
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentDirectoryErrorLastProcessWindows
                                                  • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                  • API String ID: 3841436932-2072961686
                                                  • Opcode ID: a1ad51ecbb38f7d2c72c7c5e417e0ca1c4443ba7d69a4109fa68cdca075e633a
                                                  • Instruction ID: 79857bd380dc542ccb7bbf7a1c32d9eb41f3895df9ee43a1834f5363a34c2d5e
                                                  • Opcode Fuzzy Hash: a1ad51ecbb38f7d2c72c7c5e417e0ca1c4443ba7d69a4109fa68cdca075e633a
                                                  • Instruction Fuzzy Hash: 77018832E01524FA4F225B59DD0AC9EBBF9DF55720B214357F80176210DB319F40A6D1
                                                  Function 00AB48D8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000000,?,00AB48AE,00000000,00AE7F08,0000000C,00AB4A05,00000000,00000002,00000000), ref: 00AB48F9
                                                  • TerminateProcess.KERNEL32(00000000,?,00AB48AE,00000000,00AE7F08,0000000C,00AB4A05,00000000,00000002,00000000), ref: 00AB4900
                                                  • ExitProcess.KERNEL32 ref: 00AB4912
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Process$CurrentExitTerminate
                                                  • String ID:
                                                  • API String ID: 1703294689-0
                                                  • Opcode ID: 29bf301b8a6c90c30700e80771f2d9068b1a50dedc59fd2d6d8fb3f56517e1c6
                                                  • Instruction ID: 9e94fdb9405ef402cfd2790678af1e28317fd44d0cd545d4c7d0ba24227c5e6b
                                                  • Opcode Fuzzy Hash: 29bf301b8a6c90c30700e80771f2d9068b1a50dedc59fd2d6d8fb3f56517e1c6
                                                  • Instruction Fuzzy Hash: 1EE0B631410248ABCF11AFA8DE0AE893F6DEF49782F014014F8198A223CB36DD52CA90
                                                  Function 00A8394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                  • RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateProcess
                                                  • String ID:
                                                  • API String ID: 1357844191-0
                                                  • Opcode ID: a9e781f3d4d7388855f0b9f8f47c196e797a537f17fc7dff3fb651fc8aa90517
                                                  • Instruction ID: dc6d7e1930dedabe3865300865f7b55690d95abc1888df088811365c4f1e2a72
                                                  • Opcode Fuzzy Hash: a9e781f3d4d7388855f0b9f8f47c196e797a537f17fc7dff3fb651fc8aa90517
                                                  • Instruction Fuzzy Hash: 44C012721A420CAB8F009FF4DC0EC56379CF714602B088500B505C2110C739E0148770
                                                  Function 00A8F9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 0 a8f9e3-a8fa14 call ac39af 3 a8fa18-a8fa1a 0->3 4 a8fa16 0->4 5 a8fa1c-a8fa29 call ac0237 3->5 6 a8fa2e-a8fa47 call ac32f3 3->6 4->3 11 a8ff16-a8ff1b 5->11 12 a8fa49-a8fa4e 6->12 13 a8fa53-a8fa68 call ac32f3 6->13 14 a8ff1d-a8ff1f 11->14 15 a8ff23-a8ff28 11->15 16 a8ff0d-a8ff14 call ac0237 12->16 22 a8fa6a-a8fa6f 13->22 23 a8fa74-a8fa81 call a8ea42 13->23 14->15 19 a8ff2a-a8ff2c 15->19 20 a8ff30-a8ff35 15->20 28 a8ff15 16->28 19->20 25 a8ff3d-a8ff41 20->25 26 a8ff37-a8ff39 20->26 22->16 33 a8fa8d-a8faa2 call ac32f3 23->33 34 a8fa83-a8fa88 23->34 29 a8ff4b-a8ff52 25->29 30 a8ff43-a8ff46 call ac5636 25->30 26->25 28->11 30->29 37 a8faae-a8fac0 call ac4c97 33->37 38 a8faa4-a8faa9 33->38 34->16 41 a8facf-a8fae4 call ac32f3 37->41 42 a8fac2-a8faca 37->42 38->16 47 a8faf0-a8fb05 call ac32f3 41->47 48 a8fae6-a8faeb 41->48 43 a8fd99-a8fda2 call ac0237 42->43 43->28 52 a8fb11-a8fb23 call ac3505 47->52 53 a8fb07-a8fb0c 47->53 48->16 56 a8fb2f-a8fb45 call ac39af 52->56 57 a8fb25-a8fb2a 52->57 53->16 60 a8fb4b-a8fb4d 56->60 61 a8fdf4-a8fe0e call a8ecbe 56->61 57->16 62 a8fb59-a8fb6e call ac3505 60->62 63 a8fb4f-a8fb54 60->63 68 a8fe1a-a8fe32 call ac39af 61->68 69 a8fe10-a8fe15 61->69 70 a8fb7a-a8fb8f call ac32f3 62->70 71 a8fb70-a8fb75 62->71 63->16 76 a8fe38-a8fe3a 68->76 77 a8fefc-a8fefd call a8f0f8 68->77 69->16 78 a8fb9f-a8fbb4 call ac32f3 70->78 79 a8fb91-a8fb93 70->79 71->16 80 a8fe3c-a8fe41 76->80 81 a8fe46-a8fe64 call ac32f3 76->81 86 a8ff02-a8ff06 77->86 90 a8fbc4-a8fbd9 call ac32f3 78->90 91 a8fbb6-a8fbb8 78->91 79->78 83 a8fb95-a8fb9a 79->83 80->16 92 a8fe70-a8fe88 call ac32f3 81->92 93 a8fe66-a8fe6b 81->93 83->16 86->28 87 a8ff08 86->87 87->16 101 a8fbe9-a8fbfe call ac32f3 90->101 102 a8fbdb-a8fbdd 90->102 91->90 94 a8fbba-a8fbbf 91->94 99 a8fe8a-a8fe8c 92->99 100 a8fe95-a8fead call ac32f3 92->100 93->16 94->16 99->100 106 a8fe8e-a8fe93 99->106 109 a8feba-a8fed2 call ac32f3 100->109 110 a8feaf-a8feb1 100->110 111 a8fc0e-a8fc23 call ac32f3 101->111 112 a8fc00-a8fc02 101->112 102->101 103 a8fbdf-a8fbe4 102->103 103->16 106->16 119 a8fedb-a8fef3 call ac32f3 109->119 120 a8fed4-a8fed9 109->120 110->109 113 a8feb3-a8feb8 110->113 121 a8fc33-a8fc48 call ac32f3 111->121 122 a8fc25-a8fc27 111->122 112->111 114 a8fc04-a8fc09 112->114 113->16 114->16 119->77 128 a8fef5-a8fefa 119->128 120->16 129 a8fc58-a8fc6d call ac32f3 121->129 130 a8fc4a-a8fc4c 121->130 122->121 124 a8fc29-a8fc2e 122->124 124->16 128->16 134 a8fc7d-a8fc92 call ac32f3 129->134 135 a8fc6f-a8fc71 129->135 130->129 132 a8fc4e-a8fc53 130->132 132->16 139 a8fca2-a8fcba call ac32f3 134->139 140 a8fc94-a8fc96 134->140 135->134 136 a8fc73-a8fc78 135->136 136->16 144 a8fcca-a8fce2 call ac32f3 139->144 145 a8fcbc-a8fcbe 139->145 140->139 141 a8fc98-a8fc9d 140->141 141->16 149 a8fcf2-a8fd07 call ac32f3 144->149 150 a8fce4-a8fce6 144->150 145->144 147 a8fcc0-a8fcc5 145->147 147->16 154 a8fd0d-a8fd2a CompareStringW 149->154 155 a8fda7-a8fda9 149->155 150->149 151 a8fce8-a8fced 150->151 151->16 158 a8fd2c-a8fd32 154->158 159 a8fd34-a8fd49 CompareStringW 154->159 156 a8fdab-a8fdb2 155->156 157 a8fdb4-a8fdb6 155->157 156->157 160 a8fdb8-a8fdbd 157->160 161 a8fdc2-a8fdda call ac3505 157->161 162 a8fd75-a8fd7a 158->162 163 a8fd4b-a8fd55 159->163 164 a8fd57-a8fd6c CompareStringW 159->164 160->16 161->61 171 a8fddc-a8fdde 161->171 162->157 163->162 166 a8fd7c-a8fd94 call a83821 164->166 167 a8fd6e 164->167 166->43 167->162 172 a8fdea 171->172 173 a8fde0-a8fde5 171->173 172->61 173->16
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: StringVariant$AllocClearFreeInit
                                                  • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
                                                  • API String ID: 760788290-2956246334
                                                  • Opcode ID: cc7fd2f6e151cde74e4d1ab5021de414de002e57f3db68e751fc77cadb8cf6e1
                                                  • Instruction ID: 080d1c16131d1ddfe818d07d45383c99e0f6a5208e46410abf6efd8faef35889
                                                  • Opcode Fuzzy Hash: cc7fd2f6e151cde74e4d1ab5021de414de002e57f3db68e751fc77cadb8cf6e1
                                                  • Instruction Fuzzy Hash: B7E1D172E44637BFCF21BAA4CD42FADB6A4BB15710F114636FA12F6291DB619E0097C0
                                                  Function 00A8B48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 174 a8b48b-a8b500 call aaf8e0 * 2 179 a8b538-a8b53e 174->179 180 a8b502-a8b50c GetLastError 174->180 181 a8b540 179->181 182 a8b542-a8b554 SetFilePointerEx 179->182 183 a8b519 180->183 184 a8b50e-a8b517 180->184 181->182 185 a8b588-a8b5a2 ReadFile 182->185 186 a8b556-a8b560 GetLastError 182->186 187 a8b51b 183->187 188 a8b520-a8b52d call a83821 183->188 184->183 192 a8b5d9-a8b5e0 185->192 193 a8b5a4-a8b5ae GetLastError 185->193 190 a8b56d 186->190 191 a8b562-a8b56b 186->191 187->188 203 a8b532-a8b533 188->203 197 a8b56f 190->197 198 a8b574-a8b586 call a83821 190->198 191->190 195 a8b5e6-a8b5ef 192->195 196 a8bbd7-a8bbeb call a83821 192->196 199 a8b5bb 193->199 200 a8b5b0-a8b5b9 193->200 195->196 205 a8b5f5-a8b605 SetFilePointerEx 195->205 216 a8bbf0 196->216 197->198 198->203 201 a8b5bd 199->201 202 a8b5c2-a8b5d4 call a83821 199->202 200->199 201->202 202->203 208 a8bbf1-a8bbf7 call ac0237 203->208 210 a8b63c-a8b654 ReadFile 205->210 211 a8b607-a8b611 GetLastError 205->211 230 a8bbf8-a8bc0a call aae06f 208->230 213 a8b68b-a8b692 210->213 214 a8b656-a8b660 GetLastError 210->214 218 a8b61e 211->218 219 a8b613-a8b61c 211->219 223 a8b698-a8b6a2 213->223 224 a8bbbc-a8bbd5 call a83821 213->224 220 a8b66d 214->220 221 a8b662-a8b66b 214->221 216->208 225 a8b620 218->225 226 a8b625-a8b632 call a83821 218->226 219->218 228 a8b66f 220->228 229 a8b674-a8b681 call a83821 220->229 221->220 223->224 231 a8b6a8-a8b6cb SetFilePointerEx 223->231 224->216 225->226 226->210 228->229 229->213 236 a8b6cd-a8b6d7 GetLastError 231->236 237 a8b702-a8b71a ReadFile 231->237 243 a8b6d9-a8b6e2 236->243 244 a8b6e4 236->244 239 a8b71c-a8b726 GetLastError 237->239 240 a8b751-a8b769 ReadFile 237->240 245 a8b728-a8b731 239->245 246 a8b733 239->246 247 a8b76b-a8b775 GetLastError 240->247 248 a8b7a0-a8b7bb SetFilePointerEx 240->248 243->244 249 a8b6eb-a8b6f8 call a83821 244->249 250 a8b6e6 244->250 245->246 254 a8b73a-a8b747 call a83821 246->254 255 a8b735 246->255 256 a8b782 247->256 257 a8b777-a8b780 247->257 252 a8b7bd-a8b7c7 GetLastError 248->252 253 a8b7f5-a8b814 ReadFile 248->253 249->237 250->249 263 a8b7c9-a8b7d2 252->263 264 a8b7d4 252->264 258 a8b81a-a8b81c 253->258 259 a8bb7d-a8bb87 GetLastError 253->259 254->240 255->254 260 a8b789-a8b796 call a83821 256->260 261 a8b784 256->261 257->256 266 a8b81d-a8b824 258->266 268 a8bb89-a8bb92 259->268 269 a8bb94 259->269 260->248 261->260 263->264 270 a8b7db-a8b7eb call a83821 264->270 271 a8b7d6 264->271 273 a8bb58-a8bb75 call a83821 266->273 274 a8b82a-a8b836 266->274 268->269 276 a8bb9b-a8bbb1 call a83821 269->276 277 a8bb96 269->277 270->253 271->270 289 a8bb7a-a8bb7b 273->289 280 a8b838-a8b83f 274->280 281 a8b841-a8b84a 274->281 294 a8bbb2-a8bbba call ac0237 276->294 277->276 280->281 285 a8b884-a8b88b 280->285 286 a8bb1b-a8bb32 call a83821 281->286 287 a8b850-a8b876 ReadFile 281->287 291 a8b88d-a8b8af call a83821 285->291 292 a8b8b4-a8b8cb call a8394f 285->292 300 a8bb37-a8bb3d call ac0237 286->300 287->259 290 a8b87c-a8b882 287->290 289->294 290->266 291->289 304 a8b8cd-a8b8ea call a83821 292->304 305 a8b8ef-a8b904 SetFilePointerEx 292->305 294->230 315 a8bb43-a8bb44 300->315 304->208 306 a8b944-a8b969 ReadFile 305->306 307 a8b906-a8b910 GetLastError 305->307 313 a8b96b-a8b975 GetLastError 306->313 314 a8b9a0-a8b9ac 306->314 311 a8b91d 307->311 312 a8b912-a8b91b 307->312 316 a8b91f 311->316 317 a8b924-a8b934 call a83821 311->317 312->311 320 a8b982 313->320 321 a8b977-a8b980 313->321 318 a8b9ae-a8b9ca call a83821 314->318 319 a8b9cf-a8b9d3 314->319 322 a8bb45-a8bb47 315->322 316->317 339 a8b939-a8b93f call ac0237 317->339 318->300 327 a8ba0e-a8ba21 call ac4a05 319->327 328 a8b9d5-a8ba09 call a83821 call ac0237 319->328 323 a8b989-a8b99e call a83821 320->323 324 a8b984 320->324 321->320 322->230 329 a8bb4d-a8bb53 call a83a16 322->329 323->339 324->323 341 a8ba2d-a8ba37 327->341 342 a8ba23-a8ba28 327->342 328->322 329->230 339->315 345 a8ba39-a8ba3f 341->345 346 a8ba41-a8ba49 341->346 342->339 349 a8ba5a-a8baba call a8394f 345->349 350 a8ba4b-a8ba53 346->350 351 a8ba55-a8ba58 346->351 354 a8babc-a8bad8 call a83821 349->354 355 a8bade-a8baff call aaf360 call a8b208 349->355 350->349 351->349 354->355 355->322 362 a8bb01-a8bb11 call a83821 355->362 362->286
                                                  APIs
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00A8B502
                                                  • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B550
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00A8B556
                                                  • ReadFile.KERNELBASE(00000000,00A84461,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B59E
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00A8B5A4
                                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B601
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B607
                                                  • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B650
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B656
                                                  • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B6C7
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B6CD
                                                  • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B716
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B71C
                                                  • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B765
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B76B
                                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B7B7
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B7BD
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B810
                                                  • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B872
                                                  • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B8FC
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B906
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                  • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
                                                  • API String ID: 3411815225-695169583
                                                  • Opcode ID: 48e444ded973412aaf838134cfcedbfdcbd8ec9c2f76bafc106ef80aae399cee
                                                  • Instruction ID: 855c2780326c9c77f8999995401bb1c5a4bd88a16358c7278a64b05773ce125e
                                                  • Opcode Fuzzy Hash: 48e444ded973412aaf838134cfcedbfdcbd8ec9c2f76bafc106ef80aae399cee
                                                  • Instruction Fuzzy Hash: 0512D472A50235BBDB30EB548D46FAA7AB4BF04B50F1245A9FD05BB281E7719D408BF0
                                                  Function 00AA0D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 365 aa0d16-aa0d2d SetEvent 366 aa0d6f-aa0d7d WaitForSingleObject 365->366 367 aa0d2f-aa0d39 GetLastError 365->367 370 aa0d7f-aa0d89 GetLastError 366->370 371 aa0db4-aa0dbf ResetEvent 366->371 368 aa0d3b-aa0d44 367->368 369 aa0d46 367->369 368->369 374 aa0d48 369->374 375 aa0d4d-aa0d5d call a83821 369->375 372 aa0d8b-aa0d94 370->372 373 aa0d96 370->373 376 aa0df9-aa0dff 371->376 377 aa0dc1-aa0dcb GetLastError 371->377 372->373 378 aa0d98 373->378 379 aa0d9d-aa0db2 call a83821 373->379 374->375 396 aa0d62-aa0d6a call ac0237 375->396 383 aa0e32-aa0e4b call a821ac 376->383 384 aa0e01-aa0e04 376->384 380 aa0dd8 377->380 381 aa0dcd-aa0dd6 377->381 378->379 379->396 389 aa0dda 380->389 390 aa0ddf-aa0df4 call a83821 380->390 381->380 399 aa0e4d-aa0e5e call ac0237 383->399 400 aa0e63-aa0e6e SetEvent 383->400 385 aa0e28-aa0e2d 384->385 386 aa0e06-aa0e23 call a83821 384->386 393 aa10e8-aa10ed 385->393 405 aa10de-aa10e4 call ac0237 386->405 389->390 390->396 401 aa10ef 393->401 402 aa10f2-aa10f8 393->402 396->393 419 aa10e5-aa10e7 399->419 407 aa0ea8-aa0eb6 WaitForSingleObject 400->407 408 aa0e70-aa0e7a GetLastError 400->408 401->402 405->419 410 aa0eb8-aa0ec2 GetLastError 407->410 411 aa0ef0-aa0efb ResetEvent 407->411 414 aa0e7c-aa0e85 408->414 415 aa0e87 408->415 416 aa0ecf 410->416 417 aa0ec4-aa0ecd 410->417 420 aa0efd-aa0f07 GetLastError 411->420 421 aa0f35-aa0f3c 411->421 414->415 422 aa0e89 415->422 423 aa0e8e-aa0ea3 call a83821 415->423 427 aa0ed1 416->427 428 aa0ed6-aa0eeb call a83821 416->428 417->416 419->393 429 aa0f09-aa0f12 420->429 430 aa0f14 420->430 425 aa0fab-aa0fce CreateFileW 421->425 426 aa0f3e-aa0f41 421->426 422->423 440 aa10dd 423->440 432 aa100b-aa101f SetFilePointerEx 425->432 433 aa0fd0-aa0fda GetLastError 425->433 434 aa0f6e-aa0f72 call a8394f 426->434 435 aa0f43-aa0f46 426->435 427->428 428->440 429->430 437 aa0f1b-aa0f30 call a83821 430->437 438 aa0f16 430->438 446 aa1059-aa1064 SetEndOfFile 432->446 447 aa1021-aa102b GetLastError 432->447 441 aa0fdc-aa0fe5 433->441 442 aa0fe7 433->442 458 aa0f77-aa0f7c 434->458 443 aa0f48-aa0f4b 435->443 444 aa0f67-aa0f69 435->444 437->440 438->437 440->405 441->442 452 aa0fe9 442->452 453 aa0fee-aa1001 call a83821 442->453 454 aa0f5d-aa0f62 443->454 455 aa0f4d-aa0f53 443->455 444->393 450 aa109b-aa10a8 SetFilePointerEx 446->450 451 aa1066-aa1070 GetLastError 446->451 456 aa1038 447->456 457 aa102d-aa1036 447->457 450->419 462 aa10aa-aa10b4 GetLastError 450->462 459 aa107d 451->459 460 aa1072-aa107b 451->460 452->453 453->432 454->419 455->454 465 aa103a 456->465 466 aa103f-aa1054 call a83821 456->466 457->456 463 aa0f7e-aa0f98 call a83821 458->463 464 aa0f9d-aa0fa6 458->464 468 aa107f 459->468 469 aa1084-aa1099 call a83821 459->469 460->459 471 aa10c1 462->471 472 aa10b6-aa10bf 462->472 463->440 464->419 465->466 466->440 468->469 469->440 476 aa10c8-aa10d8 call a83821 471->476 477 aa10c3 471->477 472->471 476->440 477->476
                                                  APIs
                                                  • SetEvent.KERNEL32(?,?,?,?,?,00AA08BC,?,?), ref: 00AA0D25
                                                  • GetLastError.KERNEL32(?,?,?,?,00AA08BC,?,?), ref: 00AA0D2F
                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00AA08BC,?,?), ref: 00AA0D74
                                                  • GetLastError.KERNEL32(?,?,?,?,00AA08BC,?,?), ref: 00AA0D7F
                                                  • ResetEvent.KERNEL32(?,?,?,?,?,00AA08BC,?,?), ref: 00AA0DB7
                                                  • GetLastError.KERNEL32(?,?,?,?,00AA08BC,?,?), ref: 00AA0DC1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                  • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 1865021742-2104912459
                                                  • Opcode ID: bb84cbab1a4ccff4dbb7df3f4e97f1baea32fcf5ba514bb19c62cd429b28fe31
                                                  • Instruction ID: f0cbcd691ec164effc80f4a674153b67509f7a82e4955c36f15d2e3ef9e1d85a
                                                  • Opcode Fuzzy Hash: bb84cbab1a4ccff4dbb7df3f4e97f1baea32fcf5ba514bb19c62cd429b28fe31
                                                  • Instruction Fuzzy Hash: ED914A37A91632BBD73157E98E0AF6A7964BF12B30F124A16BE11BF6C0D751DC0086E1
                                                  Function 00A84D39 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 220COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 743 a84d39-a84d81 call aaf8e0 call a833c7 748 a84d83-a84d90 call ac0237 743->748 749 a84d95-a84d9f call a998f7 743->749 754 a84f31-a84f3b 748->754 755 a84da8-a84db7 call a998fd 749->755 756 a84da1-a84da6 749->756 758 a84f3d-a84f42 CloseHandle 754->758 759 a84f46-a84f4a 754->759 763 a84dbc-a84dc0 755->763 760 a84ddd-a84df8 call a81f13 756->760 758->759 761 a84f4c-a84f51 CloseHandle 759->761 762 a84f55-a84f59 759->762 773 a84dfa-a84dff 760->773 774 a84e01-a84e15 call a96a57 760->774 761->762 765 a84f5b-a84f60 CloseHandle 762->765 766 a84f64-a84f66 762->766 767 a84dc2 763->767 768 a84dd7-a84dda 763->768 765->766 771 a84f68-a84f69 CloseHandle 766->771 772 a84f6b-a84f7f call a82782 * 2 766->772 770 a84dc7-a84dd2 call ac0237 767->770 768->760 770->754 771->772 789 a84f89-a84f8d 772->789 790 a84f81-a84f84 call ac5636 772->790 773->770 782 a84e2f-a84e43 call a96b13 774->782 783 a84e17 774->783 792 a84e4c-a84e67 call a81f55 782->792 793 a84e45-a84e4a 782->793 786 a84e1c 783->786 787 a84e21-a84e2a call ac0237 786->787 800 a84f2e 787->800 795 a84f8f-a84f92 call ac5636 789->795 796 a84f97-a84f9f 789->796 790->789 802 a84e69-a84e6e 792->802 803 a84e73-a84e8c call a81f55 792->803 793->786 795->796 800->754 802->770 806 a84e98-a84ec4 CreateProcessW 803->806 807 a84e8e-a84e93 803->807 808 a84f01-a84f17 call ac0a28 806->808 809 a84ec6-a84ed0 GetLastError 806->809 807->770 815 a84f1c-a84f20 808->815 810 a84edd 809->810 811 a84ed2-a84edb 809->811 813 a84edf 810->813 814 a84ee4-a84efc call a83821 810->814 811->810 813->814 814->787 815->754 817 a84f22-a84f29 call ac0237 815->817 817->800
                                                  APIs
                                                    • Part of subcall function 00A833C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00A810DD,?,00000000), ref: 00A833E8
                                                  • CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00A84F40
                                                  • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00A84F4F
                                                  • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00A84F5E
                                                  • CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00A84F69
                                                  Strings
                                                  • Failed to allocate parameters for unelevated process., xrefs: 00A84DFA
                                                  • Failed to append original command line., xrefs: 00A84E69
                                                  • user.cpp, xrefs: 00A84EEA
                                                  • Failed to wait for clean room process: %ls, xrefs: 00A84F23
                                                  • burn.filehandle.attached, xrefs: 00A84E17
                                                  • Failed to get path for current process., xrefs: 00A84D83
                                                  • %ls %ls, xrefs: 00A84E55
                                                  • burn.filehandle.self, xrefs: 00A84E45
                                                  • Failed to allocate full command-line., xrefs: 00A84E8E
                                                  • -%ls="%ls", xrefs: 00A84DE6
                                                  • burn.clean.room, xrefs: 00A84DDE
                                                  • Failed to launch clean room process: %ls, xrefs: 00A84EF7
                                                  • D, xrefs: 00A84EA9
                                                  • Failed to cache to clean room., xrefs: 00A84DC2
                                                  • Failed to append %ls, xrefs: 00A84E1C
                                                  • "%ls" %ls, xrefs: 00A84E7A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$FileModuleName
                                                  • String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                  • API String ID: 3884789274-2391192076
                                                  • Opcode ID: d8ae778da0fe315a0f41fa5e2b7e7d75d95b93645700ebef520234e628b045f4
                                                  • Instruction ID: a7b0108b14b363f70a3fb2d0c6c11542bec65794f5a3cbb3f2595c030c93f2a8
                                                  • Opcode Fuzzy Hash: d8ae778da0fe315a0f41fa5e2b7e7d75d95b93645700ebef520234e628b045f4
                                                  • Instruction Fuzzy Hash: DD717332D4022ABBCF11AB94CD46EEEBB78BF08720F114659FA14B7151D7359E018BE0
                                                  Function 00A9752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 820 a9752a-a9756f call aaf8e0 call a8762c 825 a9757b-a9758c call a8c407 820->825 826 a97571-a97576 820->826 832 a97598-a975a9 call a8c26e 825->832 833 a9758e-a97593 825->833 827 a97814-a9781b call ac0237 826->827 834 a9781c-a97821 827->834 842 a975ab-a975b0 832->842 843 a975b5-a975ca call a8c4c8 832->843 833->827 836 a97829-a9782d 834->836 837 a97823-a97824 call ac5636 834->837 840 a9782f-a97832 call ac5636 836->840 841 a97837-a9783c 836->841 837->836 840->841 845 a9783e-a9783f call ac5636 841->845 846 a97844-a97851 call a8c1bb 841->846 842->827 852 a975cc-a975d1 843->852 853 a975d6-a975e6 call aac001 843->853 845->846 854 a9785b-a9785f 846->854 855 a97853-a97856 call ac5636 846->855 852->827 861 a975e8-a975ed 853->861 862 a975f2-a97665 call a95c33 853->862 857 a97869-a9786d 854->857 858 a97861-a97864 call ac5636 854->858 855->854 864 a9786f-a97872 call a83a16 857->864 865 a97877-a9787f 857->865 858->857 861->827 869 a97671-a97676 862->869 870 a97667-a9766c 862->870 864->865 871 a97678 869->871 872 a9767d-a97698 call a85602 GetCurrentProcess call ac0879 869->872 870->827 871->872 876 a9769d-a976b4 call a8827b 872->876 879 a976ce-a976e5 call a8827b 876->879 880 a976b6 876->880 886 a976ee-a976f3 879->886 887 a976e7-a976ec 879->887 882 a976bb-a976c9 call ac0237 880->882 882->834 888 a9774f-a97754 886->888 889 a976f5-a97707 call a8821f 886->889 887->882 890 a97774-a9777d 888->890 891 a97756-a97768 call a8821f 888->891 899 a97709-a9770e 889->899 900 a97713-a97723 call a83436 889->900 894 a97789-a9779d call a9a50c 890->894 895 a9777f-a97782 890->895 891->890 902 a9776a-a9776f 891->902 909 a9779f-a977a4 894->909 910 a977a6 894->910 895->894 898 a97784-a97787 895->898 898->894 903 a977ac-a977af 898->903 899->827 912 a9772f-a97743 call a8821f 900->912 913 a97725-a9772a 900->913 902->827 906 a977b1-a977b4 903->906 907 a977b6-a977cc call a8d5a0 903->907 906->834 906->907 917 a977ce-a977d3 907->917 918 a977d5-a977ed call a8cbc5 907->918 909->827 910->903 912->888 919 a97745-a9774a 912->919 913->827 917->827 922 a977ef-a977f4 918->922 923 a977f6-a9780d call a8c8e6 918->923 919->827 922->827 923->834 926 a9780f 923->926 926->827
                                                  Strings
                                                  • Failed to set source process folder variable., xrefs: 00A97745
                                                  • Failed to open manifest stream., xrefs: 00A975AB
                                                  • Failed to get source process folder from path., xrefs: 00A97725
                                                  • Failed to load catalog files., xrefs: 00A9780F
                                                  • Failed to overwrite the %ls built-in variable., xrefs: 00A976BB
                                                  • Failed to get manifest stream from container., xrefs: 00A975CC
                                                  • Failed to initialize internal cache functionality., xrefs: 00A9779F
                                                  • WixBundleUILevel, xrefs: 00A976D6, 00A976E7
                                                  • Failed to extract bootstrapper application payloads., xrefs: 00A977EF
                                                  • Failed to load manifest., xrefs: 00A975E8
                                                  • WixBundleElevated, xrefs: 00A976A5, 00A976B6
                                                  • Failed to set source process path variable., xrefs: 00A97709
                                                  • Failed to initialize variables., xrefs: 00A97571
                                                  • Failed to set original source variable., xrefs: 00A9776A
                                                  • WixBundleSourceProcessFolder, xrefs: 00A97734
                                                  • WixBundleOriginalSource, xrefs: 00A97759
                                                  • Failed to get unique temporary folder for bootstrapper application., xrefs: 00A977CE
                                                  • WixBundleSourceProcessPath, xrefs: 00A976F8
                                                  • Failed to open attached UX container., xrefs: 00A9758E
                                                  • Failed to parse command line., xrefs: 00A97667
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalInitializeSection
                                                  • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                  • API String ID: 32694325-1564579409
                                                  • Opcode ID: 22b82934994c8149d7f140c4d11f9409a7a8e3af4700688a44393017bb043d9e
                                                  • Instruction ID: c7d69d7d0a7b1870c3707b2a894075ea19dafbb04ee40cc87240cd99b174ca48
                                                  • Opcode Fuzzy Hash: 22b82934994c8149d7f140c4d11f9409a7a8e3af4700688a44393017bb043d9e
                                                  • Instruction Fuzzy Hash: AAA15272F5461ABBDF129AA4CC85FEEB7ACBB04710F014666F515A7241EB30A9448BF0
                                                  Function 00A986D0 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 209fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1032 a986d0-a9871e CreateFileW 1033 a98720-a9872a GetLastError 1032->1033 1034 a98764-a98774 call ac490d 1032->1034 1035 a9872c-a98735 1033->1035 1036 a98737 1033->1036 1042 a9878c-a98797 call ac3edd 1034->1042 1043 a98776-a98787 call ac0237 1034->1043 1035->1036 1038 a98739 1036->1038 1039 a9873e-a9875f call a83821 call ac0237 1036->1039 1038->1039 1054 a98908-a9891a call aae06f 1039->1054 1047 a9879c-a987a0 1042->1047 1053 a98901-a98902 CloseHandle 1043->1053 1050 a987bb-a987c0 1047->1050 1051 a987a2-a987b6 call ac0237 1047->1051 1050->1053 1056 a987c6-a987d5 SetFilePointerEx 1050->1056 1051->1053 1053->1054 1059 a9880f-a9881f call ac4e3a 1056->1059 1060 a987d7-a987e1 GetLastError 1056->1060 1068 a9882b-a9883c SetFilePointerEx 1059->1068 1069 a98821-a98826 1059->1069 1062 a987ee 1060->1062 1063 a987e3-a987ec 1060->1063 1066 a987f0 1062->1066 1067 a987f5-a9880a call a83821 1062->1067 1063->1062 1066->1067 1071 a988f9-a98900 call ac0237 1067->1071 1072 a9883e-a98848 GetLastError 1068->1072 1073 a98876-a98886 call ac4e3a 1068->1073 1069->1071 1071->1053 1075 a9884a-a98853 1072->1075 1076 a98855 1072->1076 1073->1069 1084 a98888-a98898 call ac4e3a 1073->1084 1075->1076 1079 a9885c-a98871 call a83821 1076->1079 1080 a98857 1076->1080 1079->1071 1080->1079 1084->1069 1088 a9889a-a988ab SetFilePointerEx 1084->1088 1089 a988ad-a988b7 GetLastError 1088->1089 1090 a988e2-a988f2 call ac4e3a 1088->1090 1091 a988b9-a988c2 1089->1091 1092 a988c4 1089->1092 1090->1053 1098 a988f4 1090->1098 1091->1092 1094 a988cb-a988e0 call a83821 1092->1094 1095 a988c6 1092->1095 1094->1071 1095->1094 1098->1071
                                                  APIs
                                                  • CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00A84DBC,?,?,00000000,00A84DBC,00000000), ref: 00A98713
                                                  • GetLastError.KERNEL32 ref: 00A98720
                                                    • Part of subcall function 00AC3EDD: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00AC3F73
                                                  • SetFilePointerEx.KERNEL32(00000000,00ACB4B8,00000000,00000000,00000000,?,00000000,00ACB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A987CD
                                                  • GetLastError.KERNEL32 ref: 00A987D7
                                                  • CloseHandle.KERNELBASE(00000000,?,00000000,00ACB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A98902
                                                  Strings
                                                  • Failed to copy user from: %ls to: %ls, xrefs: 00A987A8
                                                  • cache.cpp, xrefs: 00A98744, 00A987FB, 00A98862, 00A988D1
                                                  • Failed to zero out original data offset., xrefs: 00A988F4
                                                  • Failed to create user file at path: %ls, xrefs: 00A98751
                                                  • msi.dll, xrefs: 00A98814
                                                  • Failed to seek to checksum in exe header., xrefs: 00A98805
                                                  • Failed to seek to beginning of user file: %ls, xrefs: 00A98779
                                                  • cabinet.dll, xrefs: 00A9887B
                                                  • Failed to seek to original data in exe burn section header., xrefs: 00A988DB
                                                  • Failed to seek to signature table in exe header., xrefs: 00A9886C
                                                  • Failed to update signature offset., xrefs: 00A98821
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorLast$CloseCreateHandlePointerRead
                                                  • String ID: Failed to copy user from: %ls to: %ls$Failed to create user file at path: %ls$Failed to seek to beginning of user file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
                                                  • API String ID: 3456208997-1976062716
                                                  • Opcode ID: 63c60a78e9fc0d32b9ce01ba93c782c35c774fe97023ec590cb721ddc67adfcd
                                                  • Instruction ID: 638e19262bb2f1bf9a8c4fdd98d9c59b6a0446c32e3bb61ab3f6a343a72f4d49
                                                  • Opcode Fuzzy Hash: 63c60a78e9fc0d32b9ce01ba93c782c35c774fe97023ec590cb721ddc67adfcd
                                                  • Instruction Fuzzy Hash: DA51D473B41235BBDF119B988C46FBF76A8AF05B50F124529FE01FB281EA259C0186F5
                                                  Function 00A8762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1100 a8762c-a87edf InitializeCriticalSection 1101 a87ee2-a87f06 call a85623 1100->1101 1104 a87f08-a87f0f 1101->1104 1105 a87f13-a87f24 call ac0237 1101->1105 1104->1101 1107 a87f11 1104->1107 1109 a87f27-a87f39 call aae06f 1105->1109 1107->1109
                                                  APIs
                                                  • InitializeCriticalSection.KERNEL32(00A9756B,00A853BD,00000000,00A85445), ref: 00A8764C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalInitializeSection
                                                  • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                  • API String ID: 32694325-3635313340
                                                  • Opcode ID: 2d5bff3c6916e968ae59fd0127fe05d2ee1908fa2ecbef51e532374171e9db92
                                                  • Instruction ID: 05010b7e543fa2af9b5d5081d16bee82f7ab82d4f406b479a6754b428afd7b88
                                                  • Opcode Fuzzy Hash: 2d5bff3c6916e968ae59fd0127fe05d2ee1908fa2ecbef51e532374171e9db92
                                                  • Instruction Fuzzy Hash: F23248B0C116699FEB65CF5AC9887CDFAB4BB49314F9185EED20CB6210D7B00B898F45
                                                  Function 00A982BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1112 a982ba-a98303 call aaf8e0 1115 a98309-a98317 GetCurrentProcess call ac0879 1112->1115 1116 a9847c-a98489 call a82195 1112->1116 1120 a9831c-a98329 1115->1120 1121 a98498-a984aa call aae06f 1116->1121 1122 a9848b 1116->1122 1123 a9832f-a9833e GetWindowsDirectoryW 1120->1123 1124 a983b7-a983c5 1120->1124 1125 a98490-a98497 call ac0237 1122->1125 1127 a98378-a98389 call a8337f 1123->1127 1128 a98340-a9834a GetLastError 1123->1128 1137 a983ff-a98411 UuidCreate 1124->1137 1138 a983c7-a983d1 GetLastError 1124->1138 1125->1121 1142 a9838b-a98390 1127->1142 1143 a98395-a983ab call a836a3 1127->1143 1132 a9834c-a98355 1128->1132 1133 a98357 1128->1133 1132->1133 1139 a98359 1133->1139 1140 a9835e-a98373 call a83821 1133->1140 1144 a9841a-a9842f StringFromGUID2 1137->1144 1145 a98413-a98418 1137->1145 1146 a983de 1138->1146 1147 a983d3-a983dc 1138->1147 1139->1140 1140->1125 1142->1125 1143->1137 1159 a983ad-a983b2 1143->1159 1152 a9844d-a9846e call a81f13 1144->1152 1153 a98431-a9844b call a83821 1144->1153 1145->1125 1148 a983e0 1146->1148 1149 a983e5-a983fa call a83821 1146->1149 1147->1146 1148->1149 1149->1125 1162 a98470-a98475 1152->1162 1163 a98477 1152->1163 1153->1125 1159->1125 1162->1125 1163->1116
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00A85489), ref: 00A98310
                                                    • Part of subcall function 00AC0879: OpenProcessToken.ADVAPI32(?,00000008,?,00A853BD,00000000,?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC0897
                                                    • Part of subcall function 00AC0879: GetLastError.KERNEL32(?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC08A1
                                                    • Part of subcall function 00AC0879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC092B
                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00A98336
                                                  • GetLastError.KERNEL32 ref: 00A98340
                                                  • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00A983BD
                                                  • GetLastError.KERNEL32 ref: 00A983C7
                                                  • UuidCreate.RPCRT4(?), ref: 00A98406
                                                  Strings
                                                  • Failed to copy working folder path., xrefs: 00A9848B
                                                  • Failed to ensure windows path for working folder ended in backslash., xrefs: 00A9838B
                                                  • cache.cpp, xrefs: 00A98364, 00A983EB, 00A9843C
                                                  • Failed to create working folder guid., xrefs: 00A98413
                                                  • Failed to get temp path for working folder., xrefs: 00A983F5
                                                  • Failed to concat Temp directory on windows path for working folder., xrefs: 00A983AD
                                                  • %ls%ls\, xrefs: 00A98458
                                                  • Failed to convert working folder guid into string., xrefs: 00A98446
                                                  • Temp\, xrefs: 00A98395
                                                  • Failed to append bundle id on to temp path for working folder., xrefs: 00A98470
                                                  • Failed to get windows path for working folder., xrefs: 00A9836E
                                                  • 4#v, xrefs: 00A983BD
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                  • String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                  • API String ID: 266130487-3587817078
                                                  • Opcode ID: b3d06333aadfa4b4e7d82702c1f8c616c1e778f3648eff62a4020a13fd0a7f04
                                                  • Instruction ID: 5b2ebe3ddcfc549c239f493c05f59a884b7d518de670ca3c63575106ece34631
                                                  • Opcode Fuzzy Hash: b3d06333aadfa4b4e7d82702c1f8c616c1e778f3648eff62a4020a13fd0a7f04
                                                  • Instruction Fuzzy Hash: D241E332B40725B7DB20E6E4CD4AF9B73E8AF45B10F014566BA09EB240EE79DD0086A1
                                                  Function 00AA10FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1164 aa10fb-aa1127 CoInitializeEx 1165 aa113b-aa1186 call abf483 1164->1165 1166 aa1129-aa1136 call ac0237 1164->1166 1172 aa1188-aa11ab call a83821 call ac0237 1165->1172 1173 aa11b0-aa11d2 call abf4a4 1165->1173 1171 aa139e-aa13b0 call aae06f 1166->1171 1190 aa1397-aa1398 CoUninitialize 1172->1190 1181 aa11d8-aa11e0 1173->1181 1182 aa128c-aa1297 SetEvent 1173->1182 1186 aa138f-aa1392 call abf4b4 1181->1186 1187 aa11e6-aa11ec 1181->1187 1183 aa1299-aa12a3 GetLastError 1182->1183 1184 aa12d6-aa12e4 WaitForSingleObject 1182->1184 1188 aa12b0 1183->1188 1189 aa12a5-aa12ae 1183->1189 1193 aa1318-aa1323 ResetEvent 1184->1193 1194 aa12e6-aa12f0 GetLastError 1184->1194 1186->1190 1187->1186 1192 aa11f2-aa11fa 1187->1192 1195 aa12b2 1188->1195 1196 aa12b4-aa12c4 call a83821 1188->1196 1189->1188 1190->1171 1199 aa11fc-aa11fe 1192->1199 1200 aa1274-aa1287 call ac0237 1192->1200 1197 aa135a-aa1360 1193->1197 1198 aa1325-aa132f GetLastError 1193->1198 1201 aa12fd 1194->1201 1202 aa12f2-aa12fb 1194->1202 1195->1196 1225 aa12c9-aa12d1 call ac0237 1196->1225 1208 aa138a 1197->1208 1209 aa1362-aa1365 1197->1209 1203 aa133c 1198->1203 1204 aa1331-aa133a 1198->1204 1206 aa1200 1199->1206 1207 aa1211-aa1214 1199->1207 1200->1186 1211 aa12ff 1201->1211 1212 aa1301-aa1316 call a83821 1201->1212 1202->1201 1214 aa133e 1203->1214 1215 aa1340-aa1355 call a83821 1203->1215 1204->1203 1217 aa1202-aa1204 1206->1217 1218 aa1206-aa120f 1206->1218 1221 aa126e 1207->1221 1222 aa1216 1207->1222 1208->1186 1219 aa1386-aa1388 1209->1219 1220 aa1367-aa1381 call a83821 1209->1220 1211->1212 1212->1225 1214->1215 1215->1225 1227 aa1270-aa1272 1217->1227 1218->1227 1219->1186 1220->1225 1221->1227 1229 aa126a-aa126c 1222->1229 1230 aa122b-aa1230 1222->1230 1231 aa1239-aa123e 1222->1231 1232 aa124e-aa1253 1222->1232 1233 aa125c-aa1261 1222->1233 1234 aa121d-aa1222 1222->1234 1235 aa1232-aa1237 1222->1235 1236 aa1263-aa1268 1222->1236 1237 aa1240-aa1245 1222->1237 1238 aa1247-aa124c 1222->1238 1239 aa1224-aa1229 1222->1239 1240 aa1255-aa125a 1222->1240 1225->1186 1227->1182 1227->1200 1229->1200 1230->1200 1231->1200 1232->1200 1233->1200 1234->1200 1235->1200 1236->1200 1237->1200 1238->1200 1239->1200 1240->1200
                                                  APIs
                                                  • CoInitializeEx.OLE32(00000000,00000000), ref: 00AA111D
                                                  • CoUninitialize.COMBASE ref: 00AA1398
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: InitializeUninitialize
                                                  • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 3442037557-1168358783
                                                  • Opcode ID: f8e4dd283e406205b3772351b01735526fece5c99ee9b074c54b1fe638e377f1
                                                  • Instruction ID: 4ad20551a17257e08decc34b916c23bfe6c27f87ed22c7a2e038025aa571c117
                                                  • Opcode Fuzzy Hash: f8e4dd283e406205b3772351b01735526fece5c99ee9b074c54b1fe638e377f1
                                                  • Instruction Fuzzy Hash: 3A510537A80261F78F209B948D06FFB3664AB47B60F26477AAD11BF2D0D725CD0096E5
                                                  Function 00A842D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1245 a842d7-a8432e InitializeCriticalSection * 2 call a94d05 * 2 1250 a84452-a8445c call a8b48b 1245->1250 1251 a84334 1245->1251 1256 a84461-a84465 1250->1256 1252 a8433a-a84347 1251->1252 1254 a8434d-a84379 lstrlenW * 2 CompareStringW 1252->1254 1255 a84445-a8444c 1252->1255 1257 a843cb-a843f7 lstrlenW * 2 CompareStringW 1254->1257 1258 a8437b-a8439e lstrlenW 1254->1258 1255->1250 1255->1252 1259 a84474-a8447c 1256->1259 1260 a84467-a84473 call ac0237 1256->1260 1257->1255 1261 a843f9-a8441c lstrlenW 1257->1261 1262 a8448a-a8449f call a83821 1258->1262 1263 a843a4-a843a9 1258->1263 1260->1259 1266 a84422-a84427 1261->1266 1267 a844b6-a844d0 call a83821 1261->1267 1274 a844a4-a844ab 1262->1274 1263->1262 1268 a843af-a843bf call a829ce 1263->1268 1266->1267 1271 a8442d-a8443d call a829ce 1266->1271 1267->1274 1280 a8447f-a84488 1268->1280 1281 a843c5 1268->1281 1271->1280 1283 a8443f 1271->1283 1278 a844ac-a844b4 call ac0237 1274->1278 1278->1259 1280->1278 1281->1257 1283->1255
                                                  APIs
                                                  • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00A85266,?,?,00000000,?,?), ref: 00A84303
                                                  • InitializeCriticalSection.KERNEL32(000000D0,?,?,00A85266,?,?,00000000,?,?), ref: 00A8430C
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00A85266,?,?,00000000,?,?), ref: 00A84352
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00A85266,?,?,00000000,?,?), ref: 00A8435C
                                                  • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00A85266,?,?,00000000,?,?), ref: 00A84370
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00A85266,?,?,00000000,?,?), ref: 00A84380
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00A85266,?,?,00000000,?,?), ref: 00A843D0
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00A85266,?,?,00000000,?,?), ref: 00A843DA
                                                  • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00A85266,?,?,00000000,?,?), ref: 00A843EE
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00A85266,?,?,00000000,?,?), ref: 00A843FE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                  • String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                  • API String ID: 3039292287-3209860532
                                                  • Opcode ID: e91d5eaedce35321885c626cbc771940202501d6ebf3a4240f2f7492ef442245
                                                  • Instruction ID: baa2e94e473a8a4f6c60e5331d27273415fac22ba9debe2ac06adbbb178d2eda
                                                  • Opcode Fuzzy Hash: e91d5eaedce35321885c626cbc771940202501d6ebf3a4240f2f7492ef442245
                                                  • Instruction Fuzzy Hash: 98519271A50216BFCB24EBA8DC87F9A776CFF08760F114119F615A7290D771A950CBA0
                                                  Function 00A8C28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1285 a8c28f-a8c2c1 1286 a8c32b-a8c347 GetCurrentProcess * 2 DuplicateHandle 1285->1286 1287 a8c2c3-a8c2e1 CreateFileW 1285->1287 1290 a8c349-a8c353 GetLastError 1286->1290 1291 a8c381 1286->1291 1288 a8c383-a8c389 1287->1288 1289 a8c2e7-a8c2f1 GetLastError 1287->1289 1294 a8c38b-a8c391 1288->1294 1295 a8c393 1288->1295 1292 a8c2fe 1289->1292 1293 a8c2f3-a8c2fc 1289->1293 1296 a8c360 1290->1296 1297 a8c355-a8c35e 1290->1297 1291->1288 1300 a8c300 1292->1300 1301 a8c305-a8c318 call a83821 1292->1301 1293->1292 1302 a8c395-a8c3a3 SetFilePointerEx 1294->1302 1295->1302 1298 a8c362 1296->1298 1299 a8c367-a8c37f call a83821 1296->1299 1297->1296 1298->1299 1314 a8c31d-a8c326 call ac0237 1299->1314 1300->1301 1301->1314 1305 a8c3da-a8c3e0 1302->1305 1306 a8c3a5-a8c3af GetLastError 1302->1306 1307 a8c3fe-a8c404 1305->1307 1308 a8c3e2-a8c3e6 call aa1741 1305->1308 1311 a8c3bc 1306->1311 1312 a8c3b1-a8c3ba 1306->1312 1317 a8c3eb-a8c3ef 1308->1317 1315 a8c3be 1311->1315 1316 a8c3c3-a8c3d8 call a83821 1311->1316 1312->1311 1314->1307 1315->1316 1323 a8c3f6-a8c3fd call ac0237 1316->1323 1317->1307 1320 a8c3f1 1317->1320 1320->1323 1323->1307
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00A8C47F,00A85405,?,?,00A85445), ref: 00A8C2D6
                                                  • GetLastError.KERNEL32(?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C2E7
                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?), ref: 00A8C336
                                                  • GetCurrentProcess.KERNEL32(000000FF,00000000,?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C33C
                                                  • DuplicateHandle.KERNELBASE(00000000,?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C33F
                                                  • GetLastError.KERNEL32(?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C349
                                                  • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C39B
                                                  • GetLastError.KERNEL32(?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00A8C3A5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                  • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                  • API String ID: 2619879409-373955632
                                                  • Opcode ID: ba23e02eaf13d624b98333d6af31cb0c64b725d63a994bee502d597885c5c99d
                                                  • Instruction ID: 821d3e74878f1ceb67b8f26934f4781e0dd3f0c6c1e4bfea71a10aa434c037b5
                                                  • Opcode Fuzzy Hash: ba23e02eaf13d624b98333d6af31cb0c64b725d63a994bee502d597885c5c99d
                                                  • Instruction Fuzzy Hash: 2141A676140201BBDB21AF599D45F5BBBA6EB85730F228529F914DF281E771C802DF70
                                                  Function 00AC2AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1326 ac2af7-ac2b17 call a83838 1329 ac2b1d-ac2b2b call ac4a6c 1326->1329 1330 ac2c21-ac2c25 1326->1330 1334 ac2b30-ac2b4f GetProcAddress 1329->1334 1332 ac2c2f-ac2c35 1330->1332 1333 ac2c27-ac2c2a call ac5636 1330->1333 1333->1332 1336 ac2b56-ac2b6f GetProcAddress 1334->1336 1337 ac2b51 1334->1337 1338 ac2b76-ac2b8f GetProcAddress 1336->1338 1339 ac2b71 1336->1339 1337->1336 1340 ac2b96-ac2baf GetProcAddress 1338->1340 1341 ac2b91 1338->1341 1339->1338 1342 ac2bb6-ac2bcf GetProcAddress 1340->1342 1343 ac2bb1 1340->1343 1341->1340 1344 ac2bd6-ac2bef GetProcAddress 1342->1344 1345 ac2bd1 1342->1345 1343->1342 1346 ac2bf6-ac2c10 GetProcAddress 1344->1346 1347 ac2bf1 1344->1347 1345->1344 1348 ac2c17 1346->1348 1349 ac2c12 1346->1349 1347->1346 1348->1330 1349->1348
                                                  APIs
                                                    • Part of subcall function 00A83838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A83877
                                                    • Part of subcall function 00A83838: GetLastError.KERNEL32 ref: 00A83881
                                                    • Part of subcall function 00AC4A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00AC4A9D
                                                  • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00AC2B41
                                                  • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00AC2B61
                                                  • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00AC2B81
                                                  • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00AC2BA1
                                                  • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00AC2BC1
                                                  • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00AC2BE1
                                                  • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00AC2C01
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$ErrorLast$DirectorySystem
                                                  • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                  • API String ID: 2510051996-1735120554
                                                  • Opcode ID: 1d06667c470e737ec5ab956478bea14e9ee3ace23923e928510f82ca1d6b2583
                                                  • Instruction ID: be9c40fc5f34525b0ce66949b4655a70b91ca5e73784f25a397798b2f4e8c56d
                                                  • Opcode Fuzzy Hash: 1d06667c470e737ec5ab956478bea14e9ee3ace23923e928510f82ca1d6b2583
                                                  • Instruction Fuzzy Hash: 2031E4709602DAEFDB12DFA1ED8AB5B7BA1F714744F01092AE4045A170E7B50846EF74
                                                  Function 00AA1741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00A8C3EB,?,00000000,?,00A8C47F), ref: 00AA1778
                                                  • GetLastError.KERNEL32(?,00A8C3EB,?,00000000,?,00A8C47F,00A85405,?,?,00A85445,00A85445,00000000,?,00000000), ref: 00AA1781
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorEventLast
                                                  • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                  • API String ID: 545576003-938279966
                                                  • Opcode ID: 032b8b0f1cff62af9b7ff99ab46e5d6c233419cdd1fdacb75cc91133ff5fc687
                                                  • Instruction ID: 6494883c76c8426d5b9844c9f43f31e2eb23b778fb1ec45c3679c2ab08d6d07b
                                                  • Opcode Fuzzy Hash: 032b8b0f1cff62af9b7ff99ab46e5d6c233419cdd1fdacb75cc91133ff5fc687
                                                  • Instruction Fuzzy Hash: C7210577E8063676D32156A98D46F2B7A9CFB15BB0F020626BD01BB2C0EB64DC0086E1
                                                  Function 00ABFCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00ABFCD6
                                                  • GetProcAddress.KERNEL32(SystemFunction041), ref: 00ABFCE8
                                                  • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00ABFD2B
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00ABFD3F
                                                  • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00ABFD77
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00ABFD8B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$ErrorLast
                                                  • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                  • API String ID: 4214558900-3191127217
                                                  • Opcode ID: bbc846e623273f62d29f316587aa57502b0710ed256bd0b7ee9097dd16b23f56
                                                  • Instruction ID: ff7e2fea0f096a8857d6e27aa61b1319ddd3436c171f5365e0f57ad232557b95
                                                  • Opcode Fuzzy Hash: bbc846e623273f62d29f316587aa57502b0710ed256bd0b7ee9097dd16b23f56
                                                  • Instruction Fuzzy Hash: 5721AA329513B2AFC721DB96AD4D7976B94BB10B99F0A0535ED01AF162E7618C01CBF0
                                                  Function 00AA08C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00AA08F2
                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00AA090A
                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00AA090F
                                                  • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00AA0912
                                                  • GetLastError.KERNEL32(?,?), ref: 00AA091C
                                                  • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00AA098B
                                                  • GetLastError.KERNEL32(?,?), ref: 00AA0998
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA0940, 00AA09BC
                                                  • <the>.cab, xrefs: 00AA08EB
                                                  • Failed to add virtual file pointer for cab container., xrefs: 00AA0971
                                                  • Failed to open cabinet file: %hs, xrefs: 00AA09C9
                                                  • Failed to duplicate handle to cab container., xrefs: 00AA094A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                  • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                  • API String ID: 3030546534-3446344238
                                                  • Opcode ID: d0b56019a81da5482de80085764d03b3e5f1953fc5c146a391d247d0a0d33848
                                                  • Instruction ID: 8f52e9aad31a1aef1e62c8cf378d890fb10652ccf334b55136231cf3de6e6885
                                                  • Opcode Fuzzy Hash: d0b56019a81da5482de80085764d03b3e5f1953fc5c146a391d247d0a0d33848
                                                  • Instruction Fuzzy Hash: 7031D232941235BBEB219B958D49F9FBF6CFF05760F120516FE44B7280D721AD018AE1
                                                  Function 00A96A57 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00A84E11,?,?), ref: 00A96A77
                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,?,00A84E11,?,?), ref: 00A96A7D
                                                  • DuplicateHandle.KERNELBASE(00000000,?,?,00A84E11,?,?), ref: 00A96A80
                                                  • GetLastError.KERNEL32(?,?,00A84E11,?,?), ref: 00A96A8A
                                                  • CloseHandle.KERNEL32(000000FF,?,00A84E11,?,?), ref: 00A96B03
                                                  Strings
                                                  • Failed to append the file handle to the command line., xrefs: 00A96AEB
                                                  • %ls -%ls=%u, xrefs: 00A96AD7
                                                  • burn.filehandle.attached, xrefs: 00A96AD0
                                                  • core.cpp, xrefs: 00A96AAE
                                                  • Failed to duplicate file handle for attached container., xrefs: 00A96AB8
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentHandleProcess$CloseDuplicateErrorLast
                                                  • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
                                                  • API String ID: 4224961946-4196573879
                                                  • Opcode ID: 71db0943c739b76e3f1cab427d40a0a0e46a74117840b561096ce359b7928c6b
                                                  • Instruction ID: b81f3f32db99c6811ae4bd2ec89fb9e5d81b268d4c874b2f23deaf85fdac0b32
                                                  • Opcode Fuzzy Hash: 71db0943c739b76e3f1cab427d40a0a0e46a74117840b561096ce359b7928c6b
                                                  • Instruction Fuzzy Hash: 2C11B432A51225FBCF10ABB88D06E9EBBB8AF04770F114616F921F72D0E7719D0187A0
                                                  Function 00AC0879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • OpenProcessToken.ADVAPI32(?,00000008,?,00A853BD,00000000,?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC0897
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC08A1
                                                  • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC08D3
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC08EC
                                                  • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00A9769D,00000000), ref: 00AC092B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                  • String ID: procutil.cpp
                                                  • API String ID: 4040495316-1178289305
                                                  • Opcode ID: f1cd897ef23548f7f3530374815c3db2a9f96d9b30f2eca84fbb959dfc6f52c0
                                                  • Instruction ID: a3ecba945dc99d02f52718896fc06b4916f1ce6dd4dedfa16c3dde8370124d9d
                                                  • Opcode Fuzzy Hash: f1cd897ef23548f7f3530374815c3db2a9f96d9b30f2eca84fbb959dfc6f52c0
                                                  • Instruction Fuzzy Hash: 0221A472E40229EFDB219B999C05F9EBBB8EF10710F13815AAD55AB250D3708E00DBE0
                                                  Function 00A96B13 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00A96B49
                                                  • CloseHandle.KERNEL32(00000000), ref: 00A96BB9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateFileHandle
                                                  • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
                                                  • API String ID: 3498533004-3263533295
                                                  • Opcode ID: 018faafd61e1b5c71f4401180ed3cb3c2807284e824a165ca3f4a79b524a17a9
                                                  • Instruction ID: 72c3c1fc59d46604aacd90ce1e030b8a1d41796f4a333a675440f5f50c64ce37
                                                  • Opcode Fuzzy Hash: 018faafd61e1b5c71f4401180ed3cb3c2807284e824a165ca3f4a79b524a17a9
                                                  • Instruction Fuzzy Hash: 2D11B431B40614BBCB205AA8CC06F9A7BECEF45B30F050356FA25EB2D1E370481146A1
                                                  Function 00AC3565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CoInitialize.OLE32(00000000), ref: 00AC3574
                                                  • InterlockedIncrement.KERNEL32(00AEB6C8), ref: 00AC3591
                                                  • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00AEB6B8,?,?,?,?,?,?), ref: 00AC35AC
                                                  • CLSIDFromProgID.OLE32(MSXML.DOMDocument,00AEB6B8,?,?,?,?,?,?), ref: 00AC35B8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FromProg$IncrementInitializeInterlocked
                                                  • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                  • API String ID: 2109125048-2356320334
                                                  • Opcode ID: 37fe61ef90573041c32e1b51eccb4fb09419bb3face2eab6a907173b47131bc9
                                                  • Instruction ID: 6832a797e95ca7786fdcf632b8bf67ca26546d9b28536b767616050ba0ef0ff8
                                                  • Opcode Fuzzy Hash: 37fe61ef90573041c32e1b51eccb4fb09419bb3face2eab6a907173b47131bc9
                                                  • Instruction Fuzzy Hash: 94F0A0327901AA6BCB219BA6BD0DF472DA5AB80B99F02082DE800C6150D3B0C9428AB0
                                                  Function 00AC4A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00AC4A9D
                                                  • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00AC4ACA
                                                  • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00AC4AF6
                                                  • GetLastError.KERNEL32(00000000,00ACB7A0,?,00000000,?,00000000,?,00000000), ref: 00AC4B34
                                                  • GlobalFree.KERNEL32(00000000), ref: 00AC4B65
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Global$AllocFree
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 1145190524-2967768451
                                                  • Opcode ID: fd6cc12d9a251a4052119c4ad256da9ec5cd6aa53acdddba37be89ab87135bbe
                                                  • Instruction ID: 010132df47086451586af2f78cb14b3744a5488e7d4ee7a59cda1e90e29f67b5
                                                  • Opcode Fuzzy Hash: fd6cc12d9a251a4052119c4ad256da9ec5cd6aa53acdddba37be89ab87135bbe
                                                  • Instruction Fuzzy Hash: 1931A237E40229ABDB219B998C51FAFBAB8AF48790F134159FD14E7241E731DD0086E8
                                                  Function 00AA0A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00AA0B27
                                                  • GetLastError.KERNEL32(?,?,?), ref: 00AA0B31
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA0B55
                                                  • Invalid seek type., xrefs: 00AA0ABD
                                                  • Failed to move file pointer 0x%x bytes., xrefs: 00AA0B62
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastPointer
                                                  • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                  • API String ID: 2976181284-417918914
                                                  • Opcode ID: d693eab9980ae36b4d6b4bd86c365bfe9154a6649f301cada1f729560926524a
                                                  • Instruction ID: b144fb1f0a77efe232adee7110ad30baf8f48a3c7d89ae3341916632f6c6fe4f
                                                  • Opcode Fuzzy Hash: d693eab9980ae36b4d6b4bd86c365bfe9154a6649f301cada1f729560926524a
                                                  • Instruction Fuzzy Hash: CF31A132A4161AFFCB10DFA8D985DAEB779FB05764B158115F91497290D730EE10CBA0
                                                  Function 00A84115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?), ref: 00A84123
                                                  • GetLastError.KERNEL32(?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?,00000000,00000000), ref: 00A84131
                                                  • CreateDirectoryW.KERNEL32(?,840F01E8,00A85489,?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?,00000000), ref: 00A8419A
                                                  • GetLastError.KERNEL32(?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?,00000000,00000000), ref: 00A841A4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateDirectoryErrorLast
                                                  • String ID: dirutil.cpp
                                                  • API String ID: 1375471231-2193988115
                                                  • Opcode ID: ed494e93525526f88ea01f17d336d3189ffa2b4c876105e261830dc1b3aab95f
                                                  • Instruction ID: f4816407eaa5bc477ec6cf0b2107ee2fa46374ec39ef223694e4ca6da0040152
                                                  • Opcode Fuzzy Hash: ed494e93525526f88ea01f17d336d3189ffa2b4c876105e261830dc1b3aab95f
                                                  • Instruction Fuzzy Hash: 4311D236604737A6DB317BA54C49B3BAA64EF7DB61F124321FD45EB140E3688C8193A1
                                                  Function 00A856A9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00A86595,00A86595,?,00A8563D,?,?,00000000), ref: 00A856E5
                                                  • GetLastError.KERNEL32(?,00A8563D,?,?,00000000,?,?,00A86595,?,00A87F02,?,?,?,?,?), ref: 00A85714
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareErrorLastString
                                                  • String ID: Failed to compare strings.$variable.cpp$version.dll
                                                  • API String ID: 1733990998-4228644734
                                                  • Opcode ID: 5dcedfe5c5165320bd181708418bfa83631232c378250db8943088a996e7ac58
                                                  • Instruction ID: 0631e71a0702303db95a08dcf58717094235a8809bc576aa7ba98888f6babf73
                                                  • Opcode Fuzzy Hash: 5dcedfe5c5165320bd181708418bfa83631232c378250db8943088a996e7ac58
                                                  • Instruction Fuzzy Hash: 83210437E40925EBC7149FA8CD45E59BBA4EF05770F254719ED24AB280E630EE0187A0
                                                  Function 00AC0A28 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00A84F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00AC0A38
                                                  • GetLastError.KERNEL32(?,?,00A84F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00AC0A46
                                                  • GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 00AC0A8B
                                                  • GetLastError.KERNEL32(?,?,00A84F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00AC0A95
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeExitObjectProcessSingleWait
                                                  • String ID: procutil.cpp
                                                  • API String ID: 590199018-1178289305
                                                  • Opcode ID: 645da4ec81e82b207d4758e55743f70b2a13a04389c6f912947df48c6e8165f5
                                                  • Instruction ID: c29e22f2c20728b312695f59d32802bbefce2f1f124fcbfcd4f8111af1a98b4d
                                                  • Opcode Fuzzy Hash: 645da4ec81e82b207d4758e55743f70b2a13a04389c6f912947df48c6e8165f5
                                                  • Instruction Fuzzy Hash: 6511A577D55335EBCB20CB958909F9E7BA4EF047A0F134259FD54AB280D2318D009AE5
                                                  Function 00AA09EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AA140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00AA0A19,?,?,?), ref: 00AA1434
                                                    • Part of subcall function 00AA140C: GetLastError.KERNEL32(?,00AA0A19,?,?,?), ref: 00AA143E
                                                  • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00AA0A27
                                                  • GetLastError.KERNEL32 ref: 00AA0A31
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA0A55
                                                  • Failed to read during cabinet extraction., xrefs: 00AA0A5F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$PointerRead
                                                  • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                  • API String ID: 2170121939-2426083571
                                                  • Opcode ID: 58e5485c664c073442b6455d0c95d8a1dbce2fe1fd3c79f7bc4f3cac8face5c0
                                                  • Instruction ID: 235de54f570b697a2f49a006675fd3afcd1d10724025bb1019ad467cb16a6c85
                                                  • Opcode Fuzzy Hash: 58e5485c664c073442b6455d0c95d8a1dbce2fe1fd3c79f7bc4f3cac8face5c0
                                                  • Instruction Fuzzy Hash: 2211CE36A00229BBCB219F99DD04E9A7F68FB097A0F024115FD04A7290C731991087E0
                                                  Function 00AA140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00AA0A19,?,?,?), ref: 00AA1434
                                                  • GetLastError.KERNEL32(?,00AA0A19,?,?,?), ref: 00AA143E
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA1462
                                                  • Failed to move to virtual file pointer., xrefs: 00AA146C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastPointer
                                                  • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                  • API String ID: 2976181284-3005670968
                                                  • Opcode ID: cac3a37b9d9eeb2ba8b97ba553866ebb07676d04421b2a1353e1374099709eda
                                                  • Instruction ID: 9b3c98152487a31f28fbfe1f0fd65d2e3b998283fdcecf5ffdde769c0a8a2005
                                                  • Opcode Fuzzy Hash: cac3a37b9d9eeb2ba8b97ba553866ebb07676d04421b2a1353e1374099709eda
                                                  • Instruction Fuzzy Hash: 77018477540635B78B215B999C09E9BBB68FF05770F128129FD285B291D7319C10C6D4
                                                  Function 00AC3EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00AC3F73
                                                  • GetLastError.KERNEL32 ref: 00AC3FD6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastRead
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 1948546556-2967768451
                                                  • Opcode ID: 2f292e61469053ae441b002f3520dc7cfd1947241a80300ca1317fc6cb6f3e71
                                                  • Instruction ID: 61a91f464de9479d47179fc01d4ff1b347bde4dfc78792284453e992c7d28606
                                                  • Opcode Fuzzy Hash: 2f292e61469053ae441b002f3520dc7cfd1947241a80300ca1317fc6cb6f3e71
                                                  • Instruction Fuzzy Hash: 2C315272E002699BDF21CF59C940FDA77B4BB08751F0284AEF949AB240D7B59EC48BD4
                                                  Function 00AC4E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00AC3F9A,?,?,?), ref: 00AC4E5E
                                                  • GetLastError.KERNEL32(?,?,00AC3F9A,?,?,?), ref: 00AC4E68
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastWrite
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 442123175-2967768451
                                                  • Opcode ID: 954cda73a5a3f23b991441aae8fbeac424f2f7a96015703aaa3b86acdfb78b44
                                                  • Instruction ID: 051eb6e36add5ca011cf0815645cdb5d0bc9d54602f1d050ba420eb2899c9fe9
                                                  • Opcode Fuzzy Hash: 954cda73a5a3f23b991441aae8fbeac424f2f7a96015703aaa3b86acdfb78b44
                                                  • Instruction Fuzzy Hash: 98F04B33A00229ABC720DA9ACD45FDBBBADFB58761F020219FD04D7140D731AA0086E4
                                                  Function 00AC490D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00A98770,00000000,00000000,00000000,00000000,00000000), ref: 00AC4925
                                                  • GetLastError.KERNEL32(?,?,?,00A98770,00000000,00000000,00000000,00000000,00000000), ref: 00AC492F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastPointer
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 2976181284-2967768451
                                                  • Opcode ID: 4bcd1d290e5011742477f9171b64841e88ff838b309f86a5250f1a13c3ddb839
                                                  • Instruction ID: def4bf729e4854bb871d4636e2a888a76008dd7387a413f6c8ed327c71227dbe
                                                  • Opcode Fuzzy Hash: 4bcd1d290e5011742477f9171b64841e88ff838b309f86a5250f1a13c3ddb839
                                                  • Instruction Fuzzy Hash: 02F08176A00139AB9B20CF85DD05EAB7FA8EF087A0F024158BD44AB221E731DC10D7E4
                                                  Function 00A83838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A83877
                                                  • GetLastError.KERNEL32 ref: 00A83881
                                                  • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00A838EA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: DirectoryErrorLastLibraryLoadSystem
                                                  • String ID:
                                                  • API String ID: 1230559179-0
                                                  • Opcode ID: 06a34954a46a7c8251c3551ab805c7ab2a2acffea0e59bb96769a10c6961fcdc
                                                  • Instruction ID: bca1be09a70661219bedb39b6a950354d2f2d20917ac99ece4f855acc890b3e7
                                                  • Opcode Fuzzy Hash: 06a34954a46a7c8251c3551ab805c7ab2a2acffea0e59bb96769a10c6961fcdc
                                                  • Instruction Fuzzy Hash: DF21C8B3D0123D67DF20EBA9CD59F9A77689B04B10F1505A5FD14E7241EA70DE448BE0
                                                  Function 00A83A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00A83BB6,00000000,?,00A81474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00A813B8), ref: 00A83A20
                                                  • RtlFreeHeap.NTDLL(00000000,?,00A83BB6,00000000,?,00A81474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00A813B8,000001C7,00000100), ref: 00A83A27
                                                  • GetLastError.KERNEL32(?,00A83BB6,00000000,?,00A81474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00A813B8,000001C7,00000100,?), ref: 00A83A31
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ErrorFreeLastProcess
                                                  • String ID:
                                                  • API String ID: 406640338-0
                                                  • Opcode ID: c9764eb971b74b949a54c2138ff56b560bb66961a90c5b7b79f5e9565b00a2bc
                                                  • Instruction ID: e31c51c6ad44e73cb525ad9381689a1f270471b20ca473e8444d73abe1f5c368
                                                  • Opcode Fuzzy Hash: c9764eb971b74b949a54c2138ff56b560bb66961a90c5b7b79f5e9565b00a2bc
                                                  • Instruction Fuzzy Hash: E4D0EC77A14139678A21A7E65C5D95BBE5CEB04AE2B060121FE44D6220D626890196E4
                                                  Function 00ABF4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00ABF491
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: a3de0f790afbbb4fea0cdc1979397201fb0c87bf7b6398140495664b217fc136
                                                  • Instruction ID: 56ea0bc6fe19a6ddc8eca594da2b64c96186654835065b04f60b8bd00609dc99
                                                  • Opcode Fuzzy Hash: a3de0f790afbbb4fea0cdc1979397201fb0c87bf7b6398140495664b217fc136
                                                  • Instruction Fuzzy Hash: E7B012B12695427C334451161E06D77015CC1D5F21731866EF014C1052E8641C400033
                                                  Function 00ABF49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00ABF491
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: c4b2c971d299d77c4ba514241328d30535577c0eeb3e23e6a2d61e861c62952c
                                                  • Instruction ID: 9acab610dac4ba820f6637038140fb02ffb5a4d7e10a87ba9dd0df1e8743f3a2
                                                  • Opcode Fuzzy Hash: c4b2c971d299d77c4ba514241328d30535577c0eeb3e23e6a2d61e861c62952c
                                                  • Instruction Fuzzy Hash: 65B012B12694427D334451161F07D77015CC1D5F21731456EB014C1052E8541C010033
                                                  Function 00ABF479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00ABF491
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: 46c0218fa447c9c51d122bb7d03561a5369d4c374f6e6f84838b2c61ae826ec8
                                                  • Instruction ID: ff7cd3d2647298ad3e5ff42d9b689532387d1c9aed118670906f1ee40ffe3c9f
                                                  • Opcode Fuzzy Hash: 46c0218fa447c9c51d122bb7d03561a5369d4c374f6e6f84838b2c61ae826ec8
                                                  • Instruction Fuzzy Hash: 44B012B52694427C330411121E06C77051CC1D1F21731C66EB410C0052A8501C000073
                                                  Function 00AC35C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VariantInit.OLEAUT32(?), ref: 00AC35F8
                                                    • Part of subcall function 00AC304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00AC3609,00000000,?,00000000), ref: 00AC3069
                                                    • Part of subcall function 00AC304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00AAC025,?,00A85405,?,00000000,?), ref: 00AC3075
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorHandleInitLastModuleVariant
                                                  • String ID:
                                                  • API String ID: 52713655-0
                                                  • Opcode ID: 1854c80b503eb3ca1c37233c06ae7aa1b8f4c3cb0c4e9f9f04fb7ac03283212e
                                                  • Instruction ID: b2eaa21e58039f92031f3aafa2dafd320597e29ff9763b80b593724e8af45150
                                                  • Opcode Fuzzy Hash: 1854c80b503eb3ca1c37233c06ae7aa1b8f4c3cb0c4e9f9f04fb7ac03283212e
                                                  • Instruction Fuzzy Hash: 06310076D01629ABCB11DFA9C884BDEB7F4EF08710F02456AE915AB311D6759D008BA4
                                                  Function 00A834B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00A98BD3,0000001C,80070490,00000000,00000000,80070490), ref: 00A834D5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FolderPath
                                                  • String ID:
                                                  • API String ID: 1514166925-0
                                                  • Opcode ID: d271303d1a715647d8fab52ed5859c62777d2fc7bad6f3d77f2535695a9634a6
                                                  • Instruction ID: 0c504e2ff8bfb04999e2488498239949d4d9ac81c59ad1115a8239ff6f6ee82e
                                                  • Opcode Fuzzy Hash: d271303d1a715647d8fab52ed5859c62777d2fc7bad6f3d77f2535695a9634a6
                                                  • Instruction Fuzzy Hash: CEE017B22012287BEA027EA99C09DFB7B9CAF05B65B008451BE40D6110E766EA5187B4
                                                  Function 00AC2EFE Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FreeLibrary.KERNELBASE(00000000,00000000,00A8556E,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC2F0B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeLibrary
                                                  • String ID:
                                                  • API String ID: 3664257935-0
                                                  • Opcode ID: 3b47d86780a8c7cf475cb334830def3c5b595c5d53435b1a472a44a1ee1f5da8
                                                  • Instruction ID: 9d1af6a520994090834127b7a492c0d7f8043f1aba68d18e8d7ae9c0b83d65ce
                                                  • Opcode Fuzzy Hash: 3b47d86780a8c7cf475cb334830def3c5b595c5d53435b1a472a44a1ee1f5da8
                                                  • Instruction Fuzzy Hash: 83E0E3B19362BADF8A10CFE9BDC99437BB8B608B40305420BA804CA220C7B544439FF0
                                                  Function 00AC9684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00AC966B
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: c12bb440e8b1b9c83a9ec641a7115a08130104b9cd545e250fe2a571417616a7
                                                  • Instruction ID: b76ca5881e1198f4e6ae4be7aaa1b5fb13832e5461997d6e21eebce320ccc720
                                                  • Opcode Fuzzy Hash: c12bb440e8b1b9c83a9ec641a7115a08130104b9cd545e250fe2a571417616a7
                                                  • Instruction Fuzzy Hash: 59B012A52683417C3B4451462F4BE37015CC5C0B11B32451EB018D20D1E8541C010133
                                                  Function 00AC9674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00AC966B
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: eb6d622f6c84d99f8cf0237049bce378ffe342b4cb4041a19f4b15117a362d27
                                                  • Instruction ID: fd36d9e807610a755d9d3f668fd293bfbbb57c5785067fe3e2904d5f1a8a1821
                                                  • Opcode Fuzzy Hash: eb6d622f6c84d99f8cf0237049bce378ffe342b4cb4041a19f4b15117a362d27
                                                  • Instruction Fuzzy Hash: 30B012A52685427C374461061E0BE37055CC1C0B11732C51EB404C20D1E8501C040133
                                                  Function 00AC9653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 00AC966B
                                                    • Part of subcall function 00AC998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00AC9A09
                                                    • Part of subcall function 00AC998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00AC9A1A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: 89aade9c1df6ec06e35bc79ca7bf50893423f4189aec828561411bf4613ba6c3
                                                  • Instruction ID: ea8982c18606ae7e44ea9e72bdf05fad71a673d46ecab6191d0c639be3af4f52
                                                  • Opcode Fuzzy Hash: 89aade9c1df6ec06e35bc79ca7bf50893423f4189aec828561411bf4613ba6c3
                                                  • Instruction Fuzzy Hash: 6FB012A5268241BC3B0411026E8AD37011CD5C0B11B33851EB014E10D1A8501C000237
                                                  Function 00A81361 Relevance: 1.3, APIs: 1, Instructions: 88stringCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A83BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BDB
                                                    • Part of subcall function 00A83BD3: HeapSize.KERNEL32(00000000,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BE2
                                                  • lstrlenW.KERNEL32(000001C7,000001C7,80004005,00000000,?,cabextract.cpp,000001C7), ref: 00A8139C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ProcessSizelstrlen
                                                  • String ID:
                                                  • API String ID: 3492610842-0
                                                  • Opcode ID: e376eeef7717c7c4f2b692b4854e484770f38c934793a47103609d0f297d04e2
                                                  • Instruction ID: cd4dbe719b3aaffb5389eedab02ad0e1de74cf64db469225c6cc4143b148f26e
                                                  • Opcode Fuzzy Hash: e376eeef7717c7c4f2b692b4854e484770f38c934793a47103609d0f297d04e2
                                                  • Instruction Fuzzy Hash: 8D2102B6D00218AFCF12AF69D840BADB7BDEF84360F158164EC44AB250C7359D539B80
                                                  Function 00A814B6 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00A821A8,?,00000000,?,00000000,?,00A8390C,00000000,?,00000104), ref: 00A814E8
                                                    • Part of subcall function 00A83BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BDB
                                                    • Part of subcall function 00A83BD3: HeapSize.KERNEL32(00000000,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BE2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ProcessSizelstrlen
                                                  • String ID:
                                                  • API String ID: 3492610842-0
                                                  • Opcode ID: 9aa989c4f9342a6deafdbb73797071d55d126c8fc986ccee4c9deac3768e843d
                                                  • Instruction ID: 506ebd1f737f7d2b6443e54d8abbb06d2e7284183273a8f7dec248f80a415068
                                                  • Opcode Fuzzy Hash: 9aa989c4f9342a6deafdbb73797071d55d126c8fc986ccee4c9deac3768e843d
                                                  • Instruction Fuzzy Hash: A7012D73240218ABCF157F55ECC4F9AB76D9F85750F114215FA175B151D7329C4287E0

                                                  Non-executed Functions

                                                  Function 00A8A8F1 Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysFreeString.OLEAUT32(?), ref: 00A8B11C
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00ACCA9C,000000FF,DirectorySearch,000000FF,00ACCA9C,Condition,feclient.dll,00ACCA9C,Variable,?,00ACCA9C,00ACCA9C,?,?), ref: 00A8AA29
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 00A8AA7E
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 00A8AA9A
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 00A8AABE
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 00A8AB11
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00A8AB2B
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 00A8AB53
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 00A8AB91
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 00A8ABB0
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 00A8ABCF
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 00A8AC8D
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 00A8ACA7
                                                    • Part of subcall function 00AC32F3: VariantInit.OLEAUT32(?), ref: 00AC3309
                                                    • Part of subcall function 00AC32F3: SysAllocString.OLEAUT32(?), ref: 00AC3325
                                                    • Part of subcall function 00AC32F3: VariantClear.OLEAUT32(?), ref: 00AC33AC
                                                    • Part of subcall function 00AC32F3: SysFreeString.OLEAUT32(00000000), ref: 00AC33B7
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 00A8AD06
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 00A8AD28
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00A8AD48
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 00A8AE20
                                                  • SysFreeString.OLEAUT32(?), ref: 00A8AFFE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
                                                  • String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$`Dv$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
                                                  • API String ID: 2748437055-331518940
                                                  • Opcode ID: b3cc9dae53b413491c1fc85f48e1382bb189b81f47d05b2f80cfe069434f041b
                                                  • Instruction ID: 2816e03e25313f2871200ecf775db1b8afeff5362dff9067003d04f6bad825d3
                                                  • Opcode Fuzzy Hash: b3cc9dae53b413491c1fc85f48e1382bb189b81f47d05b2f80cfe069434f041b
                                                  • Instruction Fuzzy Hash: 0122C531D48226BADF20AB988C06FAE7A74BB15730F324715F534B62D0DB70AE40D7A1
                                                  Function 00AA41EA Relevance: 43.0, Strings: 34, Instructions: 498COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to add patch properties to obfuscated argument string., xrefs: 00AA451F
                                                  • Failed to install MSI package., xrefs: 00AA4746
                                                  • Failed to initialize external UI handler., xrefs: 00AA43F4
                                                  • WixBundleExecutePackageCacheFolder, xrefs: 00AA436A, 00AA48A4
                                                  • Failed to add obfuscated properties to argument string., xrefs: 00AA4497
                                                  • Failed to get cached path for package: %ls, xrefs: 00AA434F
                                                  • Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 00AA469B
                                                  • Failed to perform minor upgrade of MSI package., xrefs: 00AA4638
                                                  • Failed to build MSI path., xrefs: 00AA439D
                                                  • %ls %ls=ALL, xrefs: 00AA46B6, 00AA4795
                                                  • Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 00AA460C
                                                  • Failed to add feature action properties to argument string., xrefs: 00AA44B9
                                                  • Failed to add properties to argument string., xrefs: 00AA4463
                                                  • Failed to add patch properties to argument string., xrefs: 00AA44FD
                                                  • Failed to add reboot suppression property on uninstall., xrefs: 00AA477D
                                                  • Failed to run maintanance mode for MSI package., xrefs: 00AA46F6
                                                  • Failed to add reinstall all property on minor upgrade., xrefs: 00AA45EA
                                                  • Failed to add the list of dependencies to ignore to the properties., xrefs: 00AA46CA
                                                  • VersionString, xrefs: 00AA428E, 00AA42EF
                                                  • Failed to add reboot suppression property on install., xrefs: 00AA45BB
                                                  • Failed to uninstall MSI package., xrefs: 00AA47EF
                                                  • msasn1.dll, xrefs: 00AA440B
                                                  • %ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 00AA4687
                                                  • Failed to enable logging for package: %ls to: %ls, xrefs: 00AA441F
                                                  • WixBundleExecutePackageAction, xrefs: 00AA43B7, 00AA48B4
                                                  • feclient.dll, xrefs: 00AA42C5, 00AA434D, 00AA441D, 00AA454B, 00AA47D8
                                                  • crypt32.dll, xrefs: 00AA440A
                                                  • REINSTALL=ALL, xrefs: 00AA45D3, 00AA464D
                                                  • ACTION=ADMIN, xrefs: 00AA4709
                                                  • REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 00AA45F5
                                                  • REBOOT=ReallySuppress, xrefs: 00AA45A0, 00AA476C
                                                  • Failed to add ADMIN property on admin install., xrefs: 00AA471E
                                                  • Failed to add feature action properties to obfuscated argument string., xrefs: 00AA44DB
                                                  • IGNOREDEPENDENCIES, xrefs: 00AA46A5, 00AA4784
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
                                                  • API String ID: 0-2033600224
                                                  • Opcode ID: 4b6b888b5b8909620b990b895da79640ad3cfdb6c1616327f075b611b84754e1
                                                  • Instruction ID: 91c55ad39edd4f5930483311f4900cf97acc6164fc7a5c916257c21cd4446475
                                                  • Opcode Fuzzy Hash: 4b6b888b5b8909620b990b895da79640ad3cfdb6c1616327f075b611b84754e1
                                                  • Instruction Fuzzy Hash: 9B02F471900626BFCF219F54CD41FA9B77ABF89310F0105A5F509A7291D7B2EEA0CB90
                                                  Function 00AC1719 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00AC17B1
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC17BB
                                                  • CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00AC1808
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC180E
                                                  • CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00AC1848
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC184E
                                                  • CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00AC188E
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC1894
                                                  • CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00AC18D4
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC18DA
                                                  • CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00AC191A
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC1920
                                                  • SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00AC1A11
                                                  • SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00AC1A4B
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC1A55
                                                  • SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00AC1A8D
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC1A97
                                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AC1AD0
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC1ADA
                                                  • CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00AC1B18
                                                  • LocalFree.KERNEL32(?), ref: 00AC1B2E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
                                                  • String ID: srputil.cpp
                                                  • API String ID: 267631441-4105181634
                                                  • Opcode ID: b95e47a9d2f9cdc3dabf979b53a5400f29297943446335f1180098845181cb14
                                                  • Instruction ID: eb2ed5d150ce2e098693d8da004907b44758cdfac2a58c43ceded3f425e4fd8b
                                                  • Opcode Fuzzy Hash: b95e47a9d2f9cdc3dabf979b53a5400f29297943446335f1180098845181cb14
                                                  • Instruction Fuzzy Hash: CDC15376D4123DABDB20DB958D49FDFFAB8AF45750F0205AAA904F7241E7709E408FA0
                                                  Function 00AAC332 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 376COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to allocate memory for dependency providers., xrefs: 00AAC6DE
                                                  • Failed to append relation type to repair arguments for related bundle package, xrefs: 00AAC5F1
                                                  • pseudobundle.cpp, xrefs: 00AAC379, 00AAC3B2, 00AAC4A1, 00AAC6D2
                                                  • Failed to copy filename for pseudo bundle., xrefs: 00AAC417
                                                  • Failed to allocate memory for pseudo bundle payload hash., xrefs: 00AAC4AD
                                                  • Failed to copy repair arguments for related bundle package, xrefs: 00AAC5D0
                                                  • Failed to copy install arguments for related bundle package, xrefs: 00AAC584
                                                  • Failed to copy display name for pseudo bundle., xrefs: 00AAC74F
                                                  • Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00AAC385
                                                  • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00AAC3BE
                                                  • Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00AAC644
                                                  • -%ls, xrefs: 00AAC34C
                                                  • Failed to copy local source path for pseudo bundle., xrefs: 00AAC43B
                                                  • Failed to copy download source for pseudo bundle., xrefs: 00AAC469
                                                  • Failed to copy cache id for pseudo bundle., xrefs: 00AAC55F
                                                  • Failed to append relation type to install arguments for related bundle package, xrefs: 00AAC5A9
                                                  • Failed to copy key for pseudo bundle., xrefs: 00AAC542
                                                  • Failed to copy key for pseudo bundle payload., xrefs: 00AAC3F3
                                                  • Failed to copy version for pseudo bundle., xrefs: 00AAC72D
                                                  • Failed to copy uninstall arguments for related bundle package, xrefs: 00AAC623
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateProcess
                                                  • String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
                                                  • API String ID: 1357844191-2832335422
                                                  • Opcode ID: 89d3048c82e3282954db89c9b225363b815336f9e8662fd57ca30e9cee79a384
                                                  • Instruction ID: 1671355db88400fa4f539f4e5e0a7c30e3b6eff98cd18278bf9e63ad3cb046b8
                                                  • Opcode Fuzzy Hash: 89d3048c82e3282954db89c9b225363b815336f9e8662fd57ca30e9cee79a384
                                                  • Instruction Fuzzy Hash: 64C1E571A40616BFEB15DF28CD45E6A77A9FF09720B04452AF906EB381DB70EC109BD0
                                                  Function 00A845EE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 141sleepshutdownCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00A84617
                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00A8461E
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00A84628
                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00A84678
                                                  • GetLastError.KERNEL32 ref: 00A84682
                                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00A846C6
                                                  • GetLastError.KERNEL32 ref: 00A846D0
                                                  • Sleep.KERNEL32(000003E8), ref: 00A8470C
                                                  • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00A8471D
                                                  • GetLastError.KERNEL32 ref: 00A84727
                                                  • CloseHandle.KERNEL32(?), ref: 00A8477D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
                                                  • String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$user.cpp
                                                  • API String ID: 2241679041-1583736410
                                                  • Opcode ID: 9d5dea68c044bf55efd6fea06f48b207cff267609c051c46feb900daa23cf3ec
                                                  • Instruction ID: 35dce968753a853d41d8c5f2008dbe413bcb18dce01237c404b035fad0366bb2
                                                  • Opcode Fuzzy Hash: 9d5dea68c044bf55efd6fea06f48b207cff267609c051c46feb900daa23cf3ec
                                                  • Instruction Fuzzy Hash: AB41D673E50226BBD720ABE59D87F6F7A68BB05B50F120529FE01BB180E7658C0087E1
                                                  Function 00A94EDF Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 165pipeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00A94F0D
                                                  • GetLastError.KERNEL32(?,00000000,?,?,00A8452F,?), ref: 00A94F16
                                                  • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,00A8452F,?), ref: 00A94FB8
                                                  • GetLastError.KERNEL32(?,00A8452F,?), ref: 00A94FC5
                                                  • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,00A8452F), ref: 00A95040
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00A8452F,?), ref: 00A9504B
                                                  • CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,00A8452F,?), ref: 00A9508B
                                                  • LocalFree.KERNEL32(00000000,?,00A8452F,?), ref: 00A950B9
                                                  Strings
                                                  • D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00A94F08
                                                  • \\.\pipe\%ls, xrefs: 00A94F6E
                                                  • \\.\pipe\%ls.Cache, xrefs: 00A9500C
                                                  • Failed to create pipe: %ls, xrefs: 00A94FF6, 00A9507C
                                                  • Failed to allocate full name of pipe: %ls, xrefs: 00A94F84
                                                  • Failed to create the security descriptor for the connection event and pipe., xrefs: 00A94F44
                                                  • pipe.cpp, xrefs: 00A94F3A, 00A94FE9, 00A9506F
                                                  • Failed to allocate full name of cache pipe: %ls, xrefs: 00A95022
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
                                                  • String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
                                                  • API String ID: 1214480349-3253666091
                                                  • Opcode ID: 5c66716f7222b46bbb3568c5d578762ef4824b969c108f6f0d9d596e55da413d
                                                  • Instruction ID: 3abf3ba8dc125b213da7cc42f31d00e92c0f0fe7628ab5a3fe42e6e41fe1fb09
                                                  • Opcode Fuzzy Hash: 5c66716f7222b46bbb3568c5d578762ef4824b969c108f6f0d9d596e55da413d
                                                  • Instruction Fuzzy Hash: 7351B832E41625BBDF219BA8CD47F9EBBB4AF08710F110525FD11BA290D3755E418BD0
                                                  Function 00ABFA62 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 173encryptionfileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00A99F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 00ABFAC7
                                                  • GetLastError.KERNEL32 ref: 00ABFAD1
                                                  • CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 00ABFB0E
                                                  • GetLastError.KERNEL32 ref: 00ABFB18
                                                  • CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00ABFB5F
                                                  • ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 00ABFB83
                                                  • GetLastError.KERNEL32 ref: 00ABFB8D
                                                  • CryptDestroyHash.ADVAPI32(00000000), ref: 00ABFBCA
                                                  • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00ABFBE1
                                                  • GetLastError.KERNEL32 ref: 00ABFBFC
                                                  • CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00ABFC34
                                                  • GetLastError.KERNEL32 ref: 00ABFC3E
                                                  • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 00ABFC77
                                                  • GetLastError.KERNEL32 ref: 00ABFC85
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
                                                  • String ID: cryputil.cpp
                                                  • API String ID: 3955742341-2185294990
                                                  • Opcode ID: ba06a017e040019c324bd0310bc147ff37ab1313c3d62c8752784a89680f3a1d
                                                  • Instruction ID: 7be89e8cf6800ef2a7700a19b98a356167681036430639ae89971fc65d0efdcb
                                                  • Opcode Fuzzy Hash: ba06a017e040019c324bd0310bc147ff37ab1313c3d62c8752784a89680f3a1d
                                                  • Instruction Fuzzy Hash: ED51D137D40239AFDB318B95CD05BDA7A68AB04751F0640B5BE48FB181E7B18D809AE0
                                                  Function 00A99E9E Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00A99FCB
                                                  • copying, xrefs: 00A9A030, 00A9A038
                                                  • moving, xrefs: 00A9A029
                                                  • Failed to create unverified path., xrefs: 00A99F6E
                                                  • Failed to get cached path for package with cache id: %ls, xrefs: 00A99EC8
                                                  • Failed to transfer working path to unverified path for payload: %ls., xrefs: 00A99FA4
                                                  • Failed to concat complete cached path., xrefs: 00A99EF4
                                                  • Failed to reset permissions on unverified cached payload: %ls, xrefs: 00A99FF1
                                                  • Failed to move verified file to complete payload path: %ls, xrefs: 00A9A06C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
                                                  • API String ID: 0-1289240508
                                                  • Opcode ID: 39ff3de955f8df86e9d79eaf2df528965a4d8d1c7bcc8ef55aa044594b21f97d
                                                  • Instruction ID: 57bdfe163998fb95c6e79a8dc8df65362f38e635427a489949b12154698415c0
                                                  • Opcode Fuzzy Hash: 39ff3de955f8df86e9d79eaf2df528965a4d8d1c7bcc8ef55aa044594b21f97d
                                                  • Instruction Fuzzy Hash: 0A515131E40119FBDF226FA8CE02FEEBBB5AF14700F154156F900B51A1E7729E60AB85
                                                  Function 00A862AA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetVersionExW.KERNEL32(0000011C), ref: 00A862F8
                                                  • GetLastError.KERNEL32 ref: 00A86302
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastVersion
                                                  • String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 305913169-1971907631
                                                  • Opcode ID: fa41d0d8c71534ed3ebda951e1da6490c929ae2508e036eb084cbd5fbe082ab6
                                                  • Instruction ID: e585051b7b368cbd3f2afc7747e477cd39b4046061c63218cc7963b36780e6ca
                                                  • Opcode Fuzzy Hash: fa41d0d8c71534ed3ebda951e1da6490c929ae2508e036eb084cbd5fbe082ab6
                                                  • Instruction Fuzzy Hash: 0941CA72E00228ABEB20EB99DD46FEF7BB8EB45710F010599F545EB181D7309E41CBA0
                                                  Function 00A86037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetSystemTime.KERNEL32(?), ref: 00A86062
                                                  • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00A86076
                                                  • GetLastError.KERNEL32 ref: 00A86088
                                                  • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00A860DC
                                                  • GetLastError.KERNEL32 ref: 00A860E6
                                                  Strings
                                                  • Failed to set variant value., xrefs: 00A86124
                                                  • Failed to allocate the buffer for the Date., xrefs: 00A860C4
                                                  • Failed to get the required buffer length for the Date., xrefs: 00A860AD
                                                  • variable.cpp, xrefs: 00A860A3, 00A86101
                                                  • Failed to get the Date., xrefs: 00A8610B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: DateErrorFormatLast$SystemTime
                                                  • String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 2700948981-3682088697
                                                  • Opcode ID: 893f352ac2b9eb43e09c94c7e9ddf455e18d0b5cd83a4990b990c6746cc08f7a
                                                  • Instruction ID: 5c937231209ac372fc30abb47fd882e34c9d400af56fa49897ca373842c6cfb4
                                                  • Opcode Fuzzy Hash: 893f352ac2b9eb43e09c94c7e9ddf455e18d0b5cd83a4990b990c6746cc08f7a
                                                  • Instruction Fuzzy Hash: BF31A932A402297BEB11EBE9CD46FAFBB78AB04710F114529FE04F7181D7619D4187E5
                                                  Function 00ABFEC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00AEB5FC,00000000,?,?,?,?,00AA12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00ABFEF4
                                                  • GetCurrentProcessId.KERNEL32(00000000,?,00AA12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00ABFF04
                                                  • GetCurrentThreadId.KERNEL32 ref: 00ABFF0D
                                                  • GetLocalTime.KERNEL32(8007139F,?,00AA12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00ABFF23
                                                  • LeaveCriticalSection.KERNEL32(00AEB5FC,00AA12CF,?,00000000,0000FDE9,?,00AA12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00AC001A
                                                  Strings
                                                  • %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00ABFFC0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                  • String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
                                                  • API String ID: 296830338-59366893
                                                  • Opcode ID: 32021f96b96b9b60f161f996c9f3fae8872c2a30ba11009ef1c05b3c900cdec5
                                                  • Instruction ID: 12c452f1fee2ddd3a649b311e826f9b04e941de5442f7706088745a671856760
                                                  • Opcode Fuzzy Hash: 32021f96b96b9b60f161f996c9f3fae8872c2a30ba11009ef1c05b3c900cdec5
                                                  • Instruction Fuzzy Hash: BF418C31E01219EFCB21DBA9CC45FBFB6B8AB08711F050529F901AA291D7359D81CBB0
                                                  Function 00A99B43 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00A99BF2
                                                  • lstrlenW.KERNEL32(?), ref: 00A99C19
                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00A99C79
                                                  • FindClose.KERNEL32(00000000), ref: 00A99C84
                                                    • Part of subcall function 00A83CC4: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00A83D40
                                                    • Part of subcall function 00A83CC4: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00A83D53
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
                                                  • String ID: *.*$.unverified
                                                  • API String ID: 457978746-2528915496
                                                  • Opcode ID: 751715fa18353349572889ee647b2be35ee107a3bd7a81985e6664f4090a3cf1
                                                  • Instruction ID: 22364117185ef8f7cb3ddfa4c4e09ed96f01686d2cac3a12344f6a85f4e572ec
                                                  • Opcode Fuzzy Hash: 751715fa18353349572889ee647b2be35ee107a3bd7a81985e6664f4090a3cf1
                                                  • Instruction Fuzzy Hash: C8417631A0056CBECF61AB68DE49FEA77F8AF44301F4001A9E508E50A0EB719EC4DF14
                                                  Function 00AC887B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00AC88D0
                                                  • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00AC88E2
                                                  Strings
                                                  • feclient.dll, xrefs: 00AC88AA
                                                  • crypt32.dll, xrefs: 00AC88A0
                                                  • %04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00AC88B9
                                                  • %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00AC892D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Time$InformationLocalSpecificSystemZone
                                                  • String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
                                                  • API String ID: 1772835396-1985132828
                                                  • Opcode ID: df7a359bebd22939db535589d9625675b565a7ee4ab12b60e8be40420bb2f9a6
                                                  • Instruction ID: 49e5c0dbcfdd121b3a321835ef9974d23bdaf73036f5c411540910fffdb2919f
                                                  • Opcode Fuzzy Hash: df7a359bebd22939db535589d9625675b565a7ee4ab12b60e8be40420bb2f9a6
                                                  • Instruction Fuzzy Hash: 0321F8A6900128EADB60DBAADC05EBFB3FCEB5C711F04455AF945D2180E739AA81D770
                                                  Function 00ABAA0E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: __floor_pentium4
                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                  • API String ID: 4168288129-2761157908
                                                  • Opcode ID: 0518d570a15640e8768d0a128b7719871dd0578bf4f6560b2ce69b05642e5d62
                                                  • Instruction ID: 7163b7544a50cb96a964152acdfe8297b12f1aa3e1b383e6b511f282c1bcd0c3
                                                  • Opcode Fuzzy Hash: 0518d570a15640e8768d0a128b7719871dd0578bf4f6560b2ce69b05642e5d62
                                                  • Instruction Fuzzy Hash: 66C24B71E146288FDB25CF28DD407EAB7B9EB55304F1441EAD40EE7242E7B8AE818F51
                                                  Function 00A861DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastNameUser
                                                  • String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 2054405381-1522884404
                                                  • Opcode ID: 335ee07108abd4da9f4fdc59ff32c54668e9acc229b4ed458d9dbb39e994acf6
                                                  • Instruction ID: d1e6f9bbade7d1a245e0e3c99e50b0d9478c9d7d091c25d474dd696ff2dc3894
                                                  • Opcode Fuzzy Hash: 335ee07108abd4da9f4fdc59ff32c54668e9acc229b4ed458d9dbb39e994acf6
                                                  • Instruction Fuzzy Hash: 9301DB32E0122867D720EB94DD46FEB7768AB10720F010599FC04E7241EB749D454BD5
                                                  Function 00ABFE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,00AC04F4,?,?,?,?,00000001), ref: 00ABFE40
                                                  • GetLastError.KERNEL32(?,00AC04F4,?,?,?,?,00000001,?,00A85616,?,?,00000000,?,?,00A85395,00000002), ref: 00ABFE4C
                                                  • LocalFree.KERNEL32(00000000,?,?,00000000,?,?,00AC04F4,?,?,?,?,00000001,?,00A85616,?,?), ref: 00ABFEB5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFormatFreeLastLocalMessage
                                                  • String ID: logutil.cpp
                                                  • API String ID: 1365068426-3545173039
                                                  • Opcode ID: 4f358b0eef68c93f044046240dac884d6b64e468b7b80ab0ec7b03e79ba1bc43
                                                  • Instruction ID: 8d632bbf99ba3b6136e6cf81fa35e1ad039489cb50ea04285381934e40e0633a
                                                  • Opcode Fuzzy Hash: 4f358b0eef68c93f044046240dac884d6b64e468b7b80ab0ec7b03e79ba1bc43
                                                  • Instruction Fuzzy Hash: 55116A32A00129EFDB219F959D06EFF7B6DEF54B10F05802AFD04A6172D7318E20D6A0
                                                  Function 00AA6B88 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00AA6B32,00000000,00000003), ref: 00AA6B9F
                                                  • GetLastError.KERNEL32(?,00AA6B32,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00AA6F28,?), ref: 00AA6BA9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ChangeConfigErrorLastService
                                                  • String ID: Failed to set service start type.$msuuser.cpp
                                                  • API String ID: 1456623077-1628545019
                                                  • Opcode ID: ec839548d030589b58a5937cceda48c829219863a95694549c1a3aeb778b188d
                                                  • Instruction ID: c2bb8e17636a57a3b7dfbfa3417a7f28510899bb6d720d2959b01a226716d591
                                                  • Opcode Fuzzy Hash: ec839548d030589b58a5937cceda48c829219863a95694549c1a3aeb778b188d
                                                  • Instruction Fuzzy Hash: 0EF0EC336851357787216BD99C05E8B7E58AF06BB0B124715FE38FB2D0DB518D0086F4
                                                  Function 00AB3C76 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00AB3D6E
                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00AB3D78
                                                  • UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00AB3D85
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                  • String ID:
                                                  • API String ID: 3906539128-0
                                                  • Opcode ID: 8fad4433238456e0f6acd60233a99ff0fca370bc8aae60df6e30303d7446948d
                                                  • Instruction ID: 721162910dfb843b27def603c429f69d73028c0af583931669c544bd323afc36
                                                  • Opcode Fuzzy Hash: 8fad4433238456e0f6acd60233a99ff0fca370bc8aae60df6e30303d7446948d
                                                  • Instruction Fuzzy Hash: 5131C47591122C9BCB21DF65D989BCCBBB8BF08310F5045EAE40CA7291E7749F858F54
                                                  Function 00AB7B87 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: /
                                                  • API String ID: 0-2043925204
                                                  • Opcode ID: 268acf293dcdd44e52cdfdbd1a2cd44cab628d07196b9be332c44957af57ae0a
                                                  • Instruction ID: 680477a08031ccf2e08b7af075c3e951b4d644152bf6312ed68850c4aa00a9ac
                                                  • Opcode Fuzzy Hash: 268acf293dcdd44e52cdfdbd1a2cd44cab628d07196b9be332c44957af57ae0a
                                                  • Instruction Fuzzy Hash: 824116725042186ECB209FB9CC89EEF7BBCEBC5314F504668F905D7282E6719D818B50
                                                  Function 00ABA560 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                  • Instruction ID: 594c36f8e3aae7df88402270fd0d4686702931fadd9ffbc6b4cba0b9f65b6cbb
                                                  • Opcode Fuzzy Hash: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                  • Instruction Fuzzy Hash: DE023B71E002199FDF14CFA9C8906EDBBF5EF58314F25816AD819E7381EB31AA41CB91
                                                  Function 00AC3A5F Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC3BF1: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00AC3A8E,?), ref: 00AC3C62
                                                  • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00AC3AB2
                                                  • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00AC3AC3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AllocateCheckCloseInitializeMembershipToken
                                                  • String ID:
                                                  • API String ID: 2114926846-0
                                                  • Opcode ID: c8b59ae0e95b8014883759153b0e833eac1007cb4e75ed9a279642d9bf512fe7
                                                  • Instruction ID: e36221b60aba3be2195d1f69cd5f80abc6a21a74c97bae49f060967ba0d8eb1c
                                                  • Opcode Fuzzy Hash: c8b59ae0e95b8014883759153b0e833eac1007cb4e75ed9a279642d9bf512fe7
                                                  • Instruction Fuzzy Hash: 0C11397290020AABDF10DFA4DD85FAFB7B8FF08340F51882DA541A6141E7729E50CB61
                                                  Function 00AC4440 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FindFirstFileW.KERNEL32(00AA923A,?,00000100,00000000,00000000), ref: 00AC447B
                                                  • FindClose.KERNEL32(00000000), ref: 00AC4487
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Find$CloseFileFirst
                                                  • String ID:
                                                  • API String ID: 2295610775-0
                                                  • Opcode ID: 5506d719f13d280af99375b4490cb468979a9f21f739ad68e1be051870678976
                                                  • Instruction ID: 23fa4c53586632cef8dd9543251056efcb747927637ceab40941e2a6c2432881
                                                  • Opcode Fuzzy Hash: 5506d719f13d280af99375b4490cb468979a9f21f739ad68e1be051870678976
                                                  • Instruction Fuzzy Hash: 7201F93160020C6BCB10EFA5EE89FABB3BCEBC5325F010565F914D3180D735AD498764
                                                  Function 00AB2C18 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 0$comres.dll
                                                  • API String ID: 0-3030269839
                                                  • Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                  • Instruction ID: 56be697728127780b3f5ebe86c29ac08c43848f37e054a7cb3279750e161f3d2
                                                  • Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                  • Instruction Fuzzy Hash: 7C519B71200B045BDF398B6C86967FF2FAD9B17340F180A1BE943DB293C609EE429352
                                                  Function 00ABEE7C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00ABEE77,?,?,00000008,?,?,00ABEB17,00000000), ref: 00ABF0A9
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ExceptionRaise
                                                  • String ID:
                                                  • API String ID: 3997070919-0
                                                  • Opcode ID: 7cdf1acd9de287c351f10594623a924c75089e3e5cb0682d6c460a42d8383580
                                                  • Instruction ID: 196719266f2b8730d687ec2754125bd2ef8f0413ee8120dc913557fab2bb9597
                                                  • Opcode Fuzzy Hash: 7cdf1acd9de287c351f10594623a924c75089e3e5cb0682d6c460a42d8383580
                                                  • Instruction Fuzzy Hash: 22B14D31610609DFD715CF2CC88ABA57BE4FF45364F298668E999CF2A2C335E991CB40
                                                  Function 00AAEC07 Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00AAEC20
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FeaturePresentProcessor
                                                  • String ID:
                                                  • API String ID: 2325560087-0
                                                  • Opcode ID: d934c2ec4409c813ecda5425c0d65235431c3bab6d6c0c4838377c5ac6028e52
                                                  • Instruction ID: c62224d81e054f4177c82d5f2aaec27546004c5344aa9c8e8d5a32e1c98fec8e
                                                  • Opcode Fuzzy Hash: d934c2ec4409c813ecda5425c0d65235431c3bab6d6c0c4838377c5ac6028e52
                                                  • Instruction Fuzzy Hash: AD518DB1D003158BDB18CF99D8C57AABBF4FB59310F15816AD405EB290E375AE11CFA1
                                                  Function 00AAE9DC Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetUnhandledExceptionFilter.KERNEL32(Function_0002E9E8,00AAE131), ref: 00AAE9E1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterUnhandled
                                                  • String ID:
                                                  • API String ID: 3192549508-0
                                                  • Opcode ID: fcc6b354619e2133e3c62160a4bc719151af0b3f4bc8bf1f164d88ef863cdf37
                                                  • Instruction ID: 4a83a6de885beb7feb8e5173f9018760eec5611035ebf3d87bb5d588f8af2cdf
                                                  • Opcode Fuzzy Hash: fcc6b354619e2133e3c62160a4bc719151af0b3f4bc8bf1f164d88ef863cdf37
                                                  • Instruction Fuzzy Hash:
                                                  Function 00AAFB89 Relevance: .5, Instructions: 481COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8c9cc4ff4a9bda77ec498470dc1d765a3a004e1d27bbfb89834a42fd1e90d826
                                                  • Instruction ID: ea9e2e7a291c9b93501556b82f7e99aca341a7fcb7299bd80c6e51161a1611f3
                                                  • Opcode Fuzzy Hash: 8c9cc4ff4a9bda77ec498470dc1d765a3a004e1d27bbfb89834a42fd1e90d826
                                                  • Instruction Fuzzy Hash: A902C3321091A20FDB2D4B79847047BBBE16A833B171E47ADD8B6CF1D6EF20D964D660
                                                  Function 00AB0B6F Relevance: .4, Instructions: 352COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                  • Instruction ID: 1b454e3cddf940d19af37d36a1e98bf750b3f668a857f8fa674cae4244b75c44
                                                  • Opcode Fuzzy Hash: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                  • Instruction Fuzzy Hash: DCC153321091A20AEF6D433984749BFBFE55A933B131A1B9DD4B2CB1D6EE20D535E620
                                                  Function 00AB07AA Relevance: .3, Instructions: 347COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                  • Instruction ID: 315b208374daa0477acc444f42ed877ff704b7379549b6623936c0dd7c548bf2
                                                  • Opcode Fuzzy Hash: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                  • Instruction Fuzzy Hash: F6C181331051A20AEF2D473984748BFBBE95E923B131B179DD4F2CB1C7EE209665D660
                                                  Function 00AB03D5 Relevance: .3, Instructions: 331COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                  • Instruction ID: cd602be5a1639f6dcf43e882f24818aee5e8fc77511e4ba24ba3d6b160e6e77d
                                                  • Opcode Fuzzy Hash: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                  • Instruction Fuzzy Hash: 1AC18F321051A24BEF2D873984748BFFBE95A923B171A179DD4B2CB0D7EE20D574DA20
                                                  Function 00AB001D Relevance: .3, Instructions: 323COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                  • Instruction ID: b864bf81c34e65b71df2990e307f416f47aabcbc90a71f2a15e94ee441e00557
                                                  • Opcode Fuzzy Hash: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                  • Instruction Fuzzy Hash: 4CB172321051A24BEF2D433D94788BFFBE95A923B131B179DD4B2CF1D6EE209529D620
                                                  Function 00AB2E47 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a3e9115e85f2afda892e9229c43fa4ea8d90a7f8813f4fec446de659c92e180c
                                                  • Instruction ID: 0495c9030aee156c1a7d705d58a8fb5e9f2458f779ce718a5ca84512aaed8fdf
                                                  • Opcode Fuzzy Hash: a3e9115e85f2afda892e9229c43fa4ea8d90a7f8813f4fec446de659c92e180c
                                                  • Instruction Fuzzy Hash: A261547264060866DF389B788995BFE67BDAF42740F10091BF983DF283D612DE928316
                                                  Function 00A8FF99 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 484registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 00A90592
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close
                                                  • String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.1.2318$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$userVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
                                                  • API String ID: 3535843008-2755343042
                                                  • Opcode ID: 98c7d27e188ee03ff5abd7eaed4befd51b9c30edc484842e0e30f171a3156052
                                                  • Instruction ID: 255df68f7fa428e33a7d53957a5aed3b4c8e2f13647a056de231b1d17d607485
                                                  • Opcode Fuzzy Hash: 98c7d27e188ee03ff5abd7eaed4befd51b9c30edc484842e0e30f171a3156052
                                                  • Instruction Fuzzy Hash: 5BF1E031B40626FFCF225668CE02FAE7AE5BB04790F164551F901B6352DB71ED60EAC0
                                                  Function 00A8CDBD Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 366COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00A8545D,00000000,00ACCA9C,00A85445,00000000), ref: 00A8CEF3
                                                  Strings
                                                  • external, xrefs: 00A8CF21
                                                  • Failed to get @Hash., xrefs: 00A8D1E3
                                                  • Failed to to find container: %ls, xrefs: 00A8D186
                                                  • Payload, xrefs: 00A8CDD8
                                                  • Failed to get @Container., xrefs: 00A8D18D
                                                  • Failed to hex decode the Payload/@Hash., xrefs: 00A8D1DC
                                                  • Failed to get @FileSize., xrefs: 00A8D1AB
                                                  • Failed to select payload nodes., xrefs: 00A8CDEB
                                                  • CertificateRootThumbprint, xrefs: 00A8D07A
                                                  • Failed to hex decode @CertificateRootThumbprint., xrefs: 00A8D1C0
                                                  • Failed to get @Packaging., xrefs: 00A8D213
                                                  • CertificateRootPublicKeyIdentifier, xrefs: 00A8D03D
                                                  • Failed to parse @FileSize., xrefs: 00A8D1A1
                                                  • Failed to get @Catalog., xrefs: 00A8D1D5
                                                  • Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00A8D1B9
                                                  • Failed to get @Id., xrefs: 00A8D221
                                                  • Failed to find catalog., xrefs: 00A8D1CE
                                                  • Failed to get @CertificateRootThumbprint., xrefs: 00A8D1C7
                                                  • FileSize, xrefs: 00A8D002
                                                  • LayoutOnly, xrefs: 00A8CF8D
                                                  • Failed to get @FilePath., xrefs: 00A8D21A
                                                  • Failed to allocate memory for payload structs., xrefs: 00A8CE49
                                                  • Invalid value for @Packaging: %ls, xrefs: 00A8D200
                                                  • download, xrefs: 00A8CEE5
                                                  • Container, xrefs: 00A8CF4B
                                                  • DownloadUrl, xrefs: 00A8CFD9
                                                  • Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00A8D1B2
                                                  • embedded, xrefs: 00A8CF05
                                                  • payload.cpp, xrefs: 00A8CE3F
                                                  • Failed to get @LayoutOnly., xrefs: 00A8D197
                                                  • Failed to get @SourcePath., xrefs: 00A8D1F1
                                                  • Failed to get @DownloadUrl., xrefs: 00A8D1EA
                                                  • Hash, xrefs: 00A8D0B7
                                                  • SourcePath, xrefs: 00A8CFB0
                                                  • Failed to get payload node count., xrefs: 00A8CE10
                                                  • Failed to get next node., xrefs: 00A8D228
                                                  • FilePath, xrefs: 00A8CEAB
                                                  • Packaging, xrefs: 00A8CEC6
                                                  • Catalog, xrefs: 00A8D0EC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateCompareProcessString
                                                  • String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$download$embedded$external$payload.cpp
                                                  • API String ID: 1171520630-3127305756
                                                  • Opcode ID: ffc3c3fdf8abff123dd6882dc7d200834508348f8ca20a1e9afda25468e2b847
                                                  • Instruction ID: 3d33568e69e352fc5075b47c4e1e6c12cdff05b7d00b846c9d53848d3dfbbc92
                                                  • Opcode Fuzzy Hash: ffc3c3fdf8abff123dd6882dc7d200834508348f8ca20a1e9afda25468e2b847
                                                  • Instruction Fuzzy Hash: 55C1BD72D44229BFCB11AB94CD45FADB776BF04B20F224669FA01BA1D0D771EE009B90
                                                  Function 00A88476 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00A85445,?,00000000,80070490,?,?,?,?,?,?,?,?,00AAC1BF,?,00A85445,?), ref: 00A884A7
                                                  • LeaveCriticalSection.KERNEL32(00A85445,?,?,?,?,?,?,?,?,00AAC1BF,?,00A85445,?,00A85445,00A85445,Chain), ref: 00A88804
                                                  Strings
                                                  • Failed to get @Type., xrefs: 00A88788
                                                  • version, xrefs: 00A8862C
                                                  • Type, xrefs: 00A885A3
                                                  • Failed to insert variable '%ls'., xrefs: 00A886C6
                                                  • Failed to set variant encryption, xrefs: 00A8879D
                                                  • string, xrefs: 00A885F7
                                                  • Initializing hidden variable '%ls', xrefs: 00A88671
                                                  • Variable, xrefs: 00A884B1
                                                  • Failed to set variant value., xrefs: 00A8878F
                                                  • Failed to get @Id., xrefs: 00A887EF
                                                  • variable.cpp, xrefs: 00A887B9
                                                  • Initializing version variable '%ls' to value '%ls', xrefs: 00A88653
                                                  • Persisted, xrefs: 00A8854A
                                                  • Attempt to set built-in variable value: %ls, xrefs: 00A887C8
                                                  • Initializing string variable '%ls' to value '%ls', xrefs: 00A8861A
                                                  • Failed to change variant type., xrefs: 00A887DA
                                                  • Failed to get variable node count., xrefs: 00A884E1
                                                  • Initializing numeric variable '%ls' to value '%ls', xrefs: 00A885E2
                                                  • Value, xrefs: 00A88565
                                                  • Invalid value for @Type: %ls, xrefs: 00A88778
                                                  • Failed to get @Hidden., xrefs: 00A887E8
                                                  • Failed to select variable nodes., xrefs: 00A884C4
                                                  • Failed to get @Persisted., xrefs: 00A887E1
                                                  • Hidden, xrefs: 00A8852F
                                                  • Failed to get next node., xrefs: 00A887F6
                                                  • Failed to set value of variable: %ls, xrefs: 00A887A7
                                                  • Failed to find variable value '%ls'., xrefs: 00A887D2
                                                  • Failed to get @Value., xrefs: 00A88796
                                                  • numeric, xrefs: 00A885BC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
                                                  • API String ID: 3168844106-1614826165
                                                  • Opcode ID: df562d534a9a9b4f9ea2f3546d81f0c7172e748a673b83587876c4827f0f5f07
                                                  • Instruction ID: acdaaec40351a907f4b5313a98d841648331752b1f286fc70ca0d310d5f7adca
                                                  • Opcode Fuzzy Hash: df562d534a9a9b4f9ea2f3546d81f0c7172e748a673b83587876c4827f0f5f07
                                                  • Instruction Fuzzy Hash: D6B1CF32D00219FBCF11EB98CD46EAEBB75BF04720F624669F914B6190DF799A409B90
                                                  Function 00AA6CCC Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 379COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00A9BDDC,00000007,?,?,?), ref: 00AA6D20
                                                    • Part of subcall function 00AC0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00A85EB2,00000000), ref: 00AC0AE0
                                                    • Part of subcall function 00AC0ACC: GetProcAddress.KERNEL32(00000000), ref: 00AC0AE7
                                                    • Part of subcall function 00AC0ACC: GetLastError.KERNEL32(?,?,?,00A85EB2,00000000), ref: 00AC0AFE
                                                  • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00AA710F
                                                  • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00AA7123
                                                  Strings
                                                  • Failed to append log switch to MSU command-line., xrefs: 00AA6EB6
                                                  • WixBundleExecutePackageCacheFolder, xrefs: 00AA6E0B, 00AA713B
                                                  • Failed to wait for executable to complete: %ls, xrefs: 00AA709E
                                                  • Failed to get cached path for package: %ls, xrefs: 00AA6DFC
                                                  • SysNative\, xrefs: 00AA6D6A
                                                  • Failed to format MSU install command., xrefs: 00AA6E5C
                                                  • Failed to append log path to MSU command-line., xrefs: 00AA6ED4
                                                  • Failed to ensure WU service was enabled to install MSU package., xrefs: 00AA6F2E
                                                  • Failed to find Windows directory., xrefs: 00AA6D5F
                                                  • Failed to build MSU path., xrefs: 00AA6E35
                                                  • Failed to format MSU uninstall command., xrefs: 00AA6E89
                                                  • D, xrefs: 00AA6F3B
                                                  • "%ls" "%ls" /quiet /norestart, xrefs: 00AA6E48
                                                  • 2, xrefs: 00AA6FB3
                                                  • Failed to allocate WUSA.exe path., xrefs: 00AA6DB3
                                                  • "%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00AA6E75
                                                  • Failed to determine WOW64 status., xrefs: 00AA6D32
                                                  • msuuser.cpp, xrefs: 00AA6F8D, 00AA7022, 00AA704A
                                                  • Failed to get process exit code., xrefs: 00AA702C
                                                  • Bootstrapper application aborted during MSU progress., xrefs: 00AA7054
                                                  • wusa.exe, xrefs: 00AA6DA0
                                                  • Failed to get action arguments for MSU package., xrefs: 00AA6DD6
                                                  • Failed to CreateProcess on path: %ls, xrefs: 00AA6F9A
                                                  • Failed to append SysNative directory., xrefs: 00AA6D7D
                                                  • /log:, xrefs: 00AA6EA2
                                                  • Failed to find System32 directory., xrefs: 00AA6D95
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
                                                  • String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuuser.cpp$wusa.exe
                                                  • API String ID: 1400713077-4261965642
                                                  • Opcode ID: 521b0eb37ee68b223bc89bc32d5721044cb4cdd1fdebefa559ab7ab2e9c0ff89
                                                  • Instruction ID: e80b78263ff689460be3f58147d0a8b1faac524f9c2b614fbe579431f5137d21
                                                  • Opcode Fuzzy Hash: 521b0eb37ee68b223bc89bc32d5721044cb4cdd1fdebefa559ab7ab2e9c0ff89
                                                  • Instruction Fuzzy Hash: B3D19F71A4070AFBDF12AFE4CD86FAFBAB8BF19700F140426F601A7191D7B59A449B50
                                                  Function 00AC744A Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 340COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00AC755D
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7726
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC77C3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$FreeHeap$AllocateCompareProcess
                                                  • String ID: ($@$`Dv$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
                                                  • API String ID: 1555028553-177796383
                                                  • Opcode ID: e02a27d24a94a076081b0e0ae97c90219bf502589625a0b61d588986f9e865e2
                                                  • Instruction ID: 94b0c0ad882d8fe477e3933d459ac3d5c3c1adcf89f20cb888b32aee6ec863dd
                                                  • Opcode Fuzzy Hash: e02a27d24a94a076081b0e0ae97c90219bf502589625a0b61d588986f9e865e2
                                                  • Instruction Fuzzy Hash: B6B16E3594822ABBDB119BA4CD42FAE7A74AB14730F220759F521BB2D1D770EE10DF90
                                                  Function 00AC710D Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 298COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00AE3E78,000000FF,?,?,?), ref: 00AC71D4
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 00AC71F9
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00AC7219
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00AC7235
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00AC725D
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00AC7279
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 00AC72B2
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00AC72EB
                                                    • Part of subcall function 00AC6D50: SysFreeString.OLEAUT32(00000000), ref: 00AC6E89
                                                    • Part of subcall function 00AC6D50: SysFreeString.OLEAUT32(00000000), ref: 00AC6EC8
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC736F
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC741F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Compare$Free
                                                  • String ID: ($`Dv$atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
                                                  • API String ID: 318886736-3891805788
                                                  • Opcode ID: e7f3b27e363641858f0ea2a15bcb38579a8552c9865c3371d97eafb3706d7b6b
                                                  • Instruction ID: ff0f88401684f1ee0958cad32892f0edf9a20e5130c770205ed3a9836ed2f9e3
                                                  • Opcode Fuzzy Hash: e7f3b27e363641858f0ea2a15bcb38579a8552c9865c3371d97eafb3706d7b6b
                                                  • Instruction Fuzzy Hash: F7A18031948216FBDB219BA4CD41FAD7B74BB04730F224759F921AA2D1DB70EA40DF91
                                                  Function 00AAD43E Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 290synchronizationprocessCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • UuidCreate.RPCRT4(?), ref: 00AAD4B3
                                                  • StringFromGUID2.OLE32(?,?,00000027), ref: 00AAD4DC
                                                  • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 00AAD5C5
                                                  • GetLastError.KERNEL32(?,?,?,?), ref: 00AAD5CF
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 00AAD668
                                                  • WaitForSingleObject.KERNEL32(00ACB500,000000FF,?,?,?,?), ref: 00AAD673
                                                  • ReleaseMutex.KERNEL32(00ACB500,?,?,?,?), ref: 00AAD69D
                                                  • GetExitCodeProcess.KERNEL32(?,?), ref: 00AAD6BE
                                                  • GetLastError.KERNEL32(?,?,?,?), ref: 00AAD6CC
                                                  • GetLastError.KERNEL32(?,?,?,?), ref: 00AAD704
                                                    • Part of subcall function 00AAD33E: WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,?,00AAD642,?), ref: 00AAD357
                                                    • Part of subcall function 00AAD33E: ReleaseMutex.KERNEL32(?,?,?,?,00AAD642,?), ref: 00AAD375
                                                    • Part of subcall function 00AAD33E: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AAD3B6
                                                    • Part of subcall function 00AAD33E: ReleaseMutex.KERNEL32(?), ref: 00AAD3CD
                                                    • Part of subcall function 00AAD33E: SetEvent.KERNEL32(?), ref: 00AAD3D6
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00AAD7B9
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00AAD7D1
                                                  Strings
                                                  • D, xrefs: 00AAD5AA
                                                  • Failed to create netfx chainer., xrefs: 00AAD55E
                                                  • Failed to allocate section name., xrefs: 00AAD51D
                                                  • Failed to get netfx return code., xrefs: 00AAD6FA
                                                  • NetFxSection.%ls, xrefs: 00AAD509
                                                  • Failed to allocate netfx chainer arguments., xrefs: 00AAD593
                                                  • %ls /pipe %ls, xrefs: 00AAD57F
                                                  • Failed to create netfx chainer guid., xrefs: 00AAD4C0
                                                  • Failed to process netfx chainer message., xrefs: 00AAD648
                                                  • Failed to allocate event name., xrefs: 00AAD53F
                                                  • Failed to wait for netfx chainer process to complete, xrefs: 00AAD732
                                                  • Failed to CreateProcess on path: %ls, xrefs: 00AAD5FE
                                                  • NetFxChainer.cpp, xrefs: 00AAD4F1, 00AAD5F3, 00AAD6F0, 00AAD728
                                                  • NetFxEvent.%ls, xrefs: 00AAD52B
                                                  • Failed to convert netfx chainer guid into string., xrefs: 00AAD4FB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
                                                  • String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
                                                  • API String ID: 1533322865-1825855094
                                                  • Opcode ID: 7a7fc90638c3e8abf762817c71fe7d9a4b9de467d4664c0b57c6c3ca9a35eb85
                                                  • Instruction ID: bad9ed0448ca8aab33121759aa35b5769e046f39b817f790082a602be0d49a1d
                                                  • Opcode Fuzzy Hash: 7a7fc90638c3e8abf762817c71fe7d9a4b9de467d4664c0b57c6c3ca9a35eb85
                                                  • Instruction Fuzzy Hash: DAA1D072D00228AFDB21DBA4CD45FAEB7B8BB09310F114569F94AF7281D7759D408FA0
                                                  Function 00A954DC Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 229filepipesleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(?,?,00000000,?,00ACB500,?,00000000,?,00A8452F,?,00ACB500), ref: 00A954FD
                                                  • GetCurrentProcessId.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A95508
                                                  • SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A9553F
                                                  • ConnectNamedPipe.KERNEL32(?,00000000,?,00A8452F,?,00ACB500), ref: 00A95554
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A9555E
                                                  • Sleep.KERNEL32(00000064,?,00A8452F,?,00ACB500), ref: 00A95593
                                                  • SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955B6
                                                  • WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955D1
                                                  • WriteFile.KERNEL32(?,00A8452F,00ACB500,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955EC
                                                  • WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A95607
                                                  • ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A95622
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A9567D
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A956B1
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A956E5
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A95719
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A9574A
                                                  • GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A9577B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
                                                  • String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
                                                  • API String ID: 2944378912-2047837012
                                                  • Opcode ID: 42b349390c20c142824f33df0aedc0d754fd576f14bbe6f84efe85e96756ed0c
                                                  • Instruction ID: 3bb70dcb98867096ea7d0cdd605f9ba8223093686397db0622858747f55b1148
                                                  • Opcode Fuzzy Hash: 42b349390c20c142824f33df0aedc0d754fd576f14bbe6f84efe85e96756ed0c
                                                  • Instruction Fuzzy Hash: E371A477E81635ABDF219BF98C47BAA76E8AF04B10F164925BE01FB180D674CD0087E1
                                                  Function 00A8A416 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8A45A
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8A480
                                                  • RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 00A8A768
                                                  Strings
                                                  • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00A8A51C
                                                  • Failed to change value type., xrefs: 00A8A70F
                                                  • Unsupported registry key value type. Type = '%u', xrefs: 00A8A608
                                                  • Failed to query registry key value size., xrefs: 00A8A554
                                                  • Failed to format key string., xrefs: 00A8A465
                                                  • Failed to format value string., xrefs: 00A8A48B
                                                  • Failed to get expand environment string., xrefs: 00A8A6DD
                                                  • Failed to allocate string buffer., xrefs: 00A8A667
                                                  • RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00A8A740
                                                  • Registry key not found. Key = '%ls', xrefs: 00A8A4B4
                                                  • Failed to open registry key., xrefs: 00A8A4ED
                                                  • Failed to query registry key value., xrefs: 00A8A5DA
                                                  • Failed to clear variable., xrefs: 00A8A4D8
                                                  • search.cpp, xrefs: 00A8A54A, 00A8A57D, 00A8A5D0, 00A8A6D3
                                                  • Failed to read registry value., xrefs: 00A8A6F6
                                                  • Failed to allocate memory registry value., xrefs: 00A8A587
                                                  • Failed to set variable., xrefs: 00A8A72B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16$Close
                                                  • String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
                                                  • API String ID: 2348241696-3124384294
                                                  • Opcode ID: 8bbd5e4764e7e988d5b6099047cf49ecc1861fea03af17dfb7b568654a997831
                                                  • Instruction ID: 33a821fd51bb6bcd0f0fc95061a766750684488c760428e5e6f7e0f824739fb8
                                                  • Opcode Fuzzy Hash: 8bbd5e4764e7e988d5b6099047cf49ecc1861fea03af17dfb7b568654a997831
                                                  • Instruction Fuzzy Hash: 41A1F672D00129BBEF21BBE4CD45FAEBA78BF24710F168526F900B6150E7719D109BD2
                                                  Function 00A85770 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 479stringCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000000,00000000,?,00A8A8B4,00000100,000002C0,000002C0,00000100), ref: 00A85795
                                                  • lstrlenW.KERNEL32(000002C0,?,00A8A8B4,00000100,000002C0,000002C0,00000100), ref: 00A8579F
                                                  • _wcschr.LIBVCRUNTIME ref: 00A859A7
                                                  • LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,00A8A8B4,00000100,000002C0,000002C0,00000100), ref: 00A85C4A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave_wcschrlstrlen
                                                  • String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
                                                  • API String ID: 1026845265-2050445661
                                                  • Opcode ID: e7e3051aaf4bf3ead0908cd25001084a6e4e6df7d509b810037571436ee12219
                                                  • Instruction ID: 96acb1c0c522bbaa7017dbab7f1f59250eed0dc5583722d1fce66eb8c358459c
                                                  • Opcode Fuzzy Hash: e7e3051aaf4bf3ead0908cd25001084a6e4e6df7d509b810037571436ee12219
                                                  • Instruction Fuzzy Hash: F3F17272D01619FECF11EFB58945EAF7AB8EB04B60F15852AFD05AB240D7349E019FA0
                                                  Function 00AACE81 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 240synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,00AAD558,?,?,?), ref: 00AACEC7
                                                  • GetLastError.KERNEL32(?,?,00AAD558,?,?,?), ref: 00AACED4
                                                  • ReleaseMutex.KERNEL32(?), ref: 00AAD13C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
                                                  • String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
                                                  • API String ID: 3944734951-2991465304
                                                  • Opcode ID: cfa2afbccc2ffccca95e7a962f47e5a029b11ef67b950ffad08186b93e373369
                                                  • Instruction ID: 8aef197e7c1f417df3724eb8681e5c3b173d2217947a2194aeed81d1f3d240c5
                                                  • Opcode Fuzzy Hash: cfa2afbccc2ffccca95e7a962f47e5a029b11ef67b950ffad08186b93e373369
                                                  • Instruction Fuzzy Hash: 7A813976A41722FBD7219BA9CD09F9ABAB4FF05720F024514FD45AB281E771DD40CAE0
                                                  Function 00A8EA42 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC32F3: VariantInit.OLEAUT32(?), ref: 00AC3309
                                                    • Part of subcall function 00AC32F3: SysAllocString.OLEAUT32(?), ref: 00AC3325
                                                    • Part of subcall function 00AC32F3: VariantClear.OLEAUT32(?), ref: 00AC33AC
                                                    • Part of subcall function 00AC32F3: SysFreeString.OLEAUT32(00000000), ref: 00AC33B7
                                                  • CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,00ACCA9C,?,?,Action,?,?,?,00000000,00A85445), ref: 00A8EB13
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 00A8EB5D
                                                  Strings
                                                  • Failed to get RelatedBundle element count., xrefs: 00A8EA97
                                                  • Failed to get next RelatedBundle element., xrefs: 00A8EC70
                                                  • Patch, xrefs: 00A8EBDD
                                                  • Invalid value for @Action: %ls, xrefs: 00A8EC52
                                                  • version.dll, xrefs: 00A8EB70
                                                  • Failed to resize Addon code array in registration, xrefs: 00A8EC3C
                                                  • RelatedBundle, xrefs: 00A8EA50
                                                  • cabinet.dll, xrefs: 00A8EBBA
                                                  • Failed to get @Action., xrefs: 00A8EC69
                                                  • Failed to get @Id., xrefs: 00A8EC62
                                                  • Failed to resize Patch code array in registration, xrefs: 00A8EC43
                                                  • Upgrade, xrefs: 00A8EB50
                                                  • Failed to resize Detect code array in registration, xrefs: 00A8EC2E
                                                  • Addon, xrefs: 00A8EB9A
                                                  • Detect, xrefs: 00A8EB04
                                                  • Failed to get RelatedBundle nodes, xrefs: 00A8EA72
                                                  • comres.dll, xrefs: 00A8EB26
                                                  • Failed to resize Upgrade code array in registration, xrefs: 00A8EC35
                                                  • Action, xrefs: 00A8EAD0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$CompareVariant$AllocClearFreeInit
                                                  • String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
                                                  • API String ID: 702752599-259800149
                                                  • Opcode ID: 7fe1231b684ea2cc6b0f47839cd67571fefde40eb11b68b87d70684130d64919
                                                  • Instruction ID: 99b5e3da94a39c224704378a551861eb6823fda5f827bd2df5653c7cb7c4c922
                                                  • Opcode Fuzzy Hash: 7fe1231b684ea2cc6b0f47839cd67571fefde40eb11b68b87d70684130d64919
                                                  • Instruction Fuzzy Hash: 41718D71E04626FBCB10EBA8CD45EAEB7B4FB04720F204659F912A72C1D770AE11CB90
                                                  Function 00A946DC Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 185fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00A94BF5,00ACB4E8,?,feclient.dll,00000000,?,?), ref: 00A946F3
                                                  • ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00A94BF5,00ACB4E8,?,feclient.dll,00000000,?,?), ref: 00A94714
                                                  • GetLastError.KERNEL32(?,00A94BF5,00ACB4E8,?,feclient.dll,00000000,?,?), ref: 00A9471A
                                                  • ReadFile.KERNEL32(feclient.dll,00000000,00ACB518,?,00000000,00000000,00ACB519,?,00A94BF5,00ACB4E8,?,feclient.dll,00000000,?,?), ref: 00A947A8
                                                  • GetLastError.KERNEL32(?,00A94BF5,00ACB4E8,?,feclient.dll,00000000,?,?), ref: 00A947AE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastRead$CurrentProcess
                                                  • String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
                                                  • API String ID: 1233551569-452622383
                                                  • Opcode ID: 15c00513174583549969ef51f1684e9b27db929021bbb951034dc1a4eda94252
                                                  • Instruction ID: 460768ddc1563c42f27d6a9c49a5eb9ed0b13abdaa8a6886c233a1982956e9dc
                                                  • Opcode Fuzzy Hash: 15c00513174583549969ef51f1684e9b27db929021bbb951034dc1a4eda94252
                                                  • Instruction Fuzzy Hash: 3A51C437E40229B7DF21DBD58C46F6E76A8BB09B20F124665FE11BB280D7709D0297E0
                                                  Function 00AA27FC Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: StringVariant$AllocClearFreeInit
                                                  • String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
                                                  • API String ID: 760788290-1911311241
                                                  • Opcode ID: 1db23b30f9505e00dc1d4337eea48d3cfb8fecfab9ad18487dbe211db2628885
                                                  • Instruction ID: 78abccf35b52acb4b67f1db7e8ee66a2f391ab28ba2053a0eb4e54be4176d4dc
                                                  • Opcode Fuzzy Hash: 1db23b30f9505e00dc1d4337eea48d3cfb8fecfab9ad18487dbe211db2628885
                                                  • Instruction Fuzzy Hash: FA41FB72E84722F6CB21576C8C02F6FB3687B1AB30F250766F925B73C1C764991087A1
                                                  Function 00A88F72 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetStringTypeW.KERNEL32(00000001,5600ACDB,00000001,?,00A89946,?,00000000,00000000,?,?,00A8992E,?,?,00000000,?), ref: 00A88FB2
                                                  Strings
                                                  • Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00A89408
                                                  • -, xrefs: 00A89118
                                                  • Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00A893C4
                                                  • Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00A89098
                                                  • Failed to set symbol value., xrefs: 00A89060
                                                  • Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00A89380
                                                  • condition.cpp, xrefs: 00A89084, 00A8914E, 00A891CA, 00A8922E, 00A8936C, 00A893B0, 00A893F4
                                                  • Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00A891DE
                                                  • Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00A89162
                                                  • AND, xrefs: 00A892BC
                                                  • Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00A89242
                                                  • NOT, xrefs: 00A892DB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: StringType
                                                  • String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
                                                  • API String ID: 4177115715-3594736606
                                                  • Opcode ID: 4cb92ac0c140d64514e02a10819a70c8debaee41fa27916e9a6dbad66981cca1
                                                  • Instruction ID: c01a44840f04d9881596d8ce36fedf8aa78895d67f411728c81a848a248152b4
                                                  • Opcode Fuzzy Hash: 4cb92ac0c140d64514e02a10819a70c8debaee41fa27916e9a6dbad66981cca1
                                                  • Instruction Fuzzy Hash: E4F11271A00205FFDB25EF98C889FBB7BB4FB04704F188559F9159A584C3B6DA92CB90
                                                  Function 00AA1BB1 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00AA1CB8
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00AA1CD6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareHeapString$AllocateProcess
                                                  • String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeuser.cpp$forceReboot$scheduleReboot$success
                                                  • API String ID: 2664528157-1714101571
                                                  • Opcode ID: eaf92c0bf9f5011a5a84b71806ba145e36f6adb0e451eb475d7f786987577d0e
                                                  • Instruction ID: 0cffb0043018f5c416eee211b3d7200ed4cc2f439d7a6b33c2f5f1828ad5aa76
                                                  • Opcode Fuzzy Hash: eaf92c0bf9f5011a5a84b71806ba145e36f6adb0e451eb475d7f786987577d0e
                                                  • Instruction Fuzzy Hash: 8761C331A4521AFBCF119BA4CC41EAEBBB5EF46720F214659F425AB2D0DB70DE01DB90
                                                  Function 00AC77F7 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00AC7857
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00AC787C
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00AC789C
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00AC78CF
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00AC78EB
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7916
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC798D
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC79D9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Compare$Free
                                                  • String ID: `Dv$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
                                                  • API String ID: 318886736-1313079583
                                                  • Opcode ID: ec9e818e1113ef033497022d071bbe0a5e802d39fbfbf53ec643d7fb00995755
                                                  • Instruction ID: f1b9c6a47a478c62c2752c694ba1e522a270a2571d2c42e19af7cf570da7bc35
                                                  • Opcode Fuzzy Hash: ec9e818e1113ef033497022d071bbe0a5e802d39fbfbf53ec643d7fb00995755
                                                  • Instruction Fuzzy Hash: FA614172908219FBDF15DB94CD45FAEBBB8AF04320F2246A9E521A71D0D731AE50DF90
                                                  Function 00A96BCA Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 351synchronizationthreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8D4A8: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00A97040,000000B8,00000000,?,00000000,7694B390), ref: 00A8D4B7
                                                    • Part of subcall function 00A8D4A8: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00A8D4C6
                                                    • Part of subcall function 00A8D4A8: LeaveCriticalSection.KERNEL32(000000D0,?,00A97040,000000B8,00000000,?,00000000,7694B390), ref: 00A8D4DB
                                                  • CreateThread.KERNEL32(00000000,00000000,00A957BD,?,00000000,00000000), ref: 00A96E34
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00A84522,?,00ACB500,?,00A84846,?,?), ref: 00A96E43
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00A84522,?,00ACB500,?,00A84846,?,?), ref: 00A96EA0
                                                  • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00A96F92
                                                  • CloseHandle.KERNEL32(00000000), ref: 00A96F9B
                                                  • CloseHandle.KERNEL32(crypt32.dll,?,00000000,?,00000000,00000001,00000000), ref: 00A96FB5
                                                    • Part of subcall function 00AABD05: SetThreadExecutionState.KERNEL32(80000001), ref: 00AABD0A
                                                  Strings
                                                  • user cannot start apply because it is busy with another action., xrefs: 00A96C28
                                                  • Another per-user setup is already executing., xrefs: 00A96CD8
                                                  • Failed to create cache thread., xrefs: 00A96E71
                                                  • Failed to set initial apply variables., xrefs: 00A96D02
                                                  • crypt32.dll, xrefs: 00A96ECD, 00A96EE7, 00A96FB4
                                                  • Failed to elevate., xrefs: 00A96D94
                                                  • Failed while caching, aborting execution., xrefs: 00A96E98
                                                  • UX aborted apply begin., xrefs: 00A96C94
                                                  • core.cpp, xrefs: 00A96C8A, 00A96E67
                                                  • Another per-machine setup is already executing., xrefs: 00A96DC8
                                                  • Failed to cache user to working directory., xrefs: 00A96D71
                                                  • Failed to register bundle., xrefs: 00A96DEE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$CriticalSectionThread$CompareCreateEnterErrorExchangeExecutionInterlockedLastLeaveMutexReleaseState
                                                  • String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$user cannot start apply because it is busy with another action.$Failed to cache user to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
                                                  • API String ID: 2169948125-4292671789
                                                  • Opcode ID: 164ad70c1027c25408fcf950f6950fcc0a0c75d490a7869384724d9bd18b29a5
                                                  • Instruction ID: a2d072b53b245aad926e7d6c12c0c6fb326ebfb6feb29dfef0a293834ac369cd
                                                  • Opcode Fuzzy Hash: 164ad70c1027c25408fcf950f6950fcc0a0c75d490a7869384724d9bd18b29a5
                                                  • Instruction Fuzzy Hash: B6C19C72A00615ABDF119FA4C985BEE3BF8BF04715F14417AFD09AE282DB709941CBA1
                                                  Function 00AC8134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00AC8161
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00AC817C
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 00AC821F
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,00ACB518,00000000), ref: 00AC825E
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00AC82B1
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00ACB518,000000FF,true,000000FF), ref: 00AC82CF
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00AC8307
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00AC844B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
                                                  • API String ID: 1825529933-3037633208
                                                  • Opcode ID: d90b5da18745f43c08b07663f8b2c2ce1ea2465cd37478708622b8f54dbc04bc
                                                  • Instruction ID: dcbf2eb75e88c753a7ae251dcd780667af976284a01482e93c3e7b591edd15e0
                                                  • Opcode Fuzzy Hash: d90b5da18745f43c08b07663f8b2c2ce1ea2465cd37478708622b8f54dbc04bc
                                                  • Instruction Fuzzy Hash: C4B19E31644606ABCB21DF58CD85F9A77B6BB44730F264A18F935AF2D1DB74E841CB10
                                                  Function 00A9E3C8 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 146registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A9E2AF: LoadBitmapW.USER32(?,00000001), ref: 00A9E2E5
                                                    • Part of subcall function 00A9E2AF: GetLastError.KERNEL32 ref: 00A9E2F1
                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00A9E429
                                                  • RegisterClassW.USER32(?), ref: 00A9E43D
                                                  • GetLastError.KERNEL32 ref: 00A9E448
                                                  • UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00A9E54D
                                                  • DeleteObject.GDI32(00000000), ref: 00A9E55C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
                                                  • String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
                                                  • API String ID: 164797020-2188509422
                                                  • Opcode ID: 0243264bf9867bd535438c9069be5b2a01529980fef8dbf5f91a061146db2e7a
                                                  • Instruction ID: d20d52d96ea3e1f58b29eedd5e00704bbb4702edcfa3e0fec80629a5dbbbbcf5
                                                  • Opcode Fuzzy Hash: 0243264bf9867bd535438c9069be5b2a01529980fef8dbf5f91a061146db2e7a
                                                  • Instruction Fuzzy Hash: 4041AF72A10219FFEF11DBE4DD09EAEBBB9BF04710F120525FA01AA251E7319D008BA1
                                                  Function 00AA9DE1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 233threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,00AABC85,00000001), ref: 00AA9E46
                                                  • GetLastError.KERNEL32(?,00AABC85,00000001), ref: 00AA9FB6
                                                  • GetExitCodeThread.KERNEL32(00000001,00000000,?,00AABC85,00000001), ref: 00AA9FF6
                                                  • GetLastError.KERNEL32(?,00AABC85,00000001), ref: 00AAA000
                                                  Strings
                                                  • Failed to execute MSI package., xrefs: 00AA9EA6
                                                  • Invalid execute action., xrefs: 00AAA056
                                                  • Failed to load compatible package on per-machine package., xrefs: 00AA9F5C
                                                  • Cache thread exited unexpectedly., xrefs: 00AAA047
                                                  • apply.cpp, xrefs: 00AA9FDD, 00AAA027
                                                  • Failed to execute package provider registration action., xrefs: 00AA9F17
                                                  • Failed to execute EXE package., xrefs: 00AA9E7D
                                                  • Failed to execute compatible package action., xrefs: 00AA9F73
                                                  • Failed to get cache thread exit code., xrefs: 00AAA031
                                                  • Failed to wait for cache check-point., xrefs: 00AA9FE7
                                                  • Failed to execute MSP package., xrefs: 00AA9ECB
                                                  • Failed to execute dependency action., xrefs: 00AA9F36
                                                  • Failed to execute MSU package., xrefs: 00AA9EFB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
                                                  • String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
                                                  • API String ID: 3703294532-2662572847
                                                  • Opcode ID: d1ef8e2122b09da23e5f296ceee4f722399c55982d4f478942069a894aef0566
                                                  • Instruction ID: d9f8d9170cbba019c2554dca9cb855b6d21e197efa2d5fbc45b9f64a957e1c86
                                                  • Opcode Fuzzy Hash: d1ef8e2122b09da23e5f296ceee4f722399c55982d4f478942069a894aef0566
                                                  • Instruction Fuzzy Hash: E4715D71A41319EFDB10DFA4C941EBFBBB8EB55B10F11856AF905EB280D3319E009BA1
                                                  Function 00A8F210 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 183registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC3AF1: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 00AC3B3E
                                                  • RegCloseKey.ADVAPI32(00000000,?,00AD0D10,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 00A8F440
                                                    • Part of subcall function 00AC14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00A8F28D,00AD0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 00AC14BB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseValueVersion
                                                  • String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$registration.cpp
                                                  • API String ID: 2348918689-2631711097
                                                  • Opcode ID: eab95fef76a258391a5b7b766b546b1e3713cdf186ebe67e8477755416a2d89a
                                                  • Instruction ID: 720c10b0dee6a2a0ad113d6e10c10ae8684e0bd7e0a07267284103cf17bcb94e
                                                  • Opcode Fuzzy Hash: eab95fef76a258391a5b7b766b546b1e3713cdf186ebe67e8477755416a2d89a
                                                  • Instruction Fuzzy Hash: 6E51C036E41227BFCF21ABA4CD06FAEBA74FB00720F15453AF912BA251E770991097C0
                                                  Function 00AACC91 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 174processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcessId.KERNEL32(76228FB0,00000002,00000000), ref: 00AACC9D
                                                    • Part of subcall function 00A94D8D: UuidCreate.RPCRT4(?), ref: 00A94DC0
                                                  • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,00AA2401,?,?,00000000,?,?,?), ref: 00AACD7B
                                                  • GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 00AACD85
                                                  • GetProcessId.KERNEL32(00AA2401,?,?,00000000,?,?,?,?), ref: 00AACDBD
                                                    • Part of subcall function 00A954DC: lstrlenW.KERNEL32(?,?,00000000,?,00ACB500,?,00000000,?,00A8452F,?,00ACB500), ref: 00A954FD
                                                    • Part of subcall function 00A954DC: GetCurrentProcessId.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A95508
                                                    • Part of subcall function 00A954DC: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A9553F
                                                    • Part of subcall function 00A954DC: ConnectNamedPipe.KERNEL32(?,00000000,?,00A8452F,?,00ACB500), ref: 00A95554
                                                    • Part of subcall function 00A954DC: GetLastError.KERNEL32(?,00A8452F,?,00ACB500), ref: 00A9555E
                                                    • Part of subcall function 00A954DC: Sleep.KERNEL32(00000064,?,00A8452F,?,00ACB500), ref: 00A95593
                                                    • Part of subcall function 00A954DC: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955B6
                                                    • Part of subcall function 00A954DC: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955D1
                                                    • Part of subcall function 00A954DC: WriteFile.KERNEL32(?,00A8452F,00ACB500,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A955EC
                                                    • Part of subcall function 00A954DC: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00A8452F,?,00ACB500), ref: 00A95607
                                                    • Part of subcall function 00AC0A28: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00A84F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00AC0A38
                                                    • Part of subcall function 00AC0A28: GetLastError.KERNEL32(?,?,00A84F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00AC0A46
                                                  • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00AACBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 00AACE41
                                                  • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00AACBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 00AACE50
                                                  • CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,00AACBEF,?,?,?,?,?,00000000,?,?,?), ref: 00AACE67
                                                  Strings
                                                  • Failed to allocate embedded command., xrefs: 00AACD54
                                                  • Failed to wait for embedded process to connect to pipe., xrefs: 00AACDDF
                                                  • Failed to create embedded pipe name and client token., xrefs: 00AACD00
                                                  • Failed to create embedded pipe., xrefs: 00AACD27
                                                  • Failed to create embedded process at path: %ls, xrefs: 00AACDB3
                                                  • %ls -%ls %ls %ls %u, xrefs: 00AACD40
                                                  • embedded.cpp, xrefs: 00AACDA6
                                                  • burn.embedded, xrefs: 00AACD38
                                                  • Failed to process messages from embedded message., xrefs: 00AACE04
                                                  • Failed to wait for embedded executable: %ls, xrefs: 00AACE24
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
                                                  • String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
                                                  • API String ID: 875070380-3803182736
                                                  • Opcode ID: 8adc49d2cf49c80d0175713c2b760812136624157da3d5464edaf32589663385
                                                  • Instruction ID: 3d9be507c75b2047ab1d34d552bf82f38de6745249a679d2660b2589f63e8a58
                                                  • Opcode Fuzzy Hash: 8adc49d2cf49c80d0175713c2b760812136624157da3d5464edaf32589663385
                                                  • Instruction Fuzzy Hash: 6D513072D4021DBBEF219B98DD06FDEBBB8AF08721F110525FA00B7190D7719A419BD5
                                                  Function 00A8ECBE Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 173COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysFreeString.OLEAUT32(?), ref: 00A8EE4C
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • SysFreeString.OLEAUT32(?), ref: 00A8EE04
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeHeapString$AllocateProcess
                                                  • String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`Dv$registration.cpp
                                                  • API String ID: 336948655-2733233106
                                                  • Opcode ID: be167bd3836f87ec217701f2b6a9cde570fe6c6434c6215b780ecdcd97094f87
                                                  • Instruction ID: 21373363b550b650b93e8d57a1e854ae272268ad37fdfb0fe006cb3ef143d52d
                                                  • Opcode Fuzzy Hash: be167bd3836f87ec217701f2b6a9cde570fe6c6434c6215b780ecdcd97094f87
                                                  • Instruction Fuzzy Hash: 90518175E0172AFBCB11EF98C991EAEB7B8BF04B50B154569F906AB250C771DE008B90
                                                  Function 00AC7F7E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00AC8468,00000001,?), ref: 00AC7F9E
                                                  • CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00AC8468,00000001,?), ref: 00AC7FB9
                                                  • CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00AC8468,00000001,?), ref: 00AC7FD4
                                                  • CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00AC8468,00000001,?), ref: 00AC8040
                                                  • CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00AC8468,00000001,?), ref: 00AC8064
                                                  • CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00AC8468,00000001,?), ref: 00AC8088
                                                  • CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00AC8468,00000001,?), ref: 00AC80A8
                                                  • lstrlenW.KERNEL32(006C0064,?,00AC8468,00000001,?), ref: 00AC80C3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString$lstrlen
                                                  • String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
                                                  • API String ID: 1657112622-2492263259
                                                  • Opcode ID: bd18b3ff55ecb224d7c42ce08795953fd1372ce3feed7ec0dbc5605b7957b899
                                                  • Instruction ID: a4dc50b3a376cf67aab2cacd41a3fbd4100a35ec0a953ded9b9358d60c97a015
                                                  • Opcode Fuzzy Hash: bd18b3ff55ecb224d7c42ce08795953fd1372ce3feed7ec0dbc5605b7957b899
                                                  • Instruction Fuzzy Hash: 13518531688612BBDB205F55CC86F267A61FB15B30F314718F634AE2D5CBA5EC54CBA0
                                                  Function 00A8A03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8A0B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16
                                                  • String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
                                                  • API String ID: 3613110473-2134270738
                                                  • Opcode ID: e437edaab0f0a7fa29c8f6771c09f3a97dd674cca3789a4d6231ce24cffbe7f6
                                                  • Instruction ID: 391c64fcb0835d005642b3121b797ac15db2b305472d0c11e021e0de27d7fbe6
                                                  • Opcode Fuzzy Hash: e437edaab0f0a7fa29c8f6771c09f3a97dd674cca3789a4d6231ce24cffbe7f6
                                                  • Instruction Fuzzy Hash: 6E61A432D40118FBEB21FA98CD49EEE7B78FB25710F11416AF905BB251E632DE109792
                                                  Function 00A94B2A Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 158sleepfileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00A94B84
                                                  • GetLastError.KERNEL32 ref: 00A94B92
                                                  • Sleep.KERNEL32(00000064), ref: 00A94BB6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorFileLastSleep
                                                  • String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
                                                  • API String ID: 408151869-3212458075
                                                  • Opcode ID: a6d3e381602803a6bc84679670f9637e5c7f73fcc29a91d8a2eb6b88e021f08a
                                                  • Instruction ID: 7db2e3a5652114485930c2bbff64bdc7cf7936e9d3054f7ccbbd86508cfbc217
                                                  • Opcode Fuzzy Hash: a6d3e381602803a6bc84679670f9637e5c7f73fcc29a91d8a2eb6b88e021f08a
                                                  • Instruction Fuzzy Hash: 5941F736E42632BBDF2157E48D06F5A7AE8AF18721F120611FE01BB290D7759D0296E4
                                                  Function 00A8F585 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(00000000,00000000,00A904DF,InstallerVersion,InstallerVersion,00000000,00A904DF,InstallerName,InstallerName,00000000,00A904DF,Date,InstalledDate,00000000,00A904DF,LogonUser), ref: 00A8F733
                                                    • Part of subcall function 00AC14F4: RegSetValueExW.ADVAPI32(00020006,00AD0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00A8F335,00000000,?,00020006), ref: 00AC1527
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseValue
                                                  • String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
                                                  • API String ID: 3132538880-2703781546
                                                  • Opcode ID: 0e6b7193d4f4268d0f852018185f59907b45243c04e2e642fa32d0c3ad564194
                                                  • Instruction ID: 625ceaa8ae63a65f2a5beab56980293027a3ca87c0b5a86c6a80e093b625851b
                                                  • Opcode Fuzzy Hash: 0e6b7193d4f4268d0f852018185f59907b45243c04e2e642fa32d0c3ad564194
                                                  • Instruction Fuzzy Hash: 7241C431A40666FADF12B658CE02FAE7A34AF20B10F150275F901F6352DB709E10E7C4
                                                  Function 00A9E7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • TlsSetValue.KERNEL32(?,?), ref: 00A9E7FF
                                                  • RegisterClassW.USER32(?), ref: 00A9E82B
                                                  • GetLastError.KERNEL32 ref: 00A9E836
                                                  • CreateWindowExW.USER32(00000080,00AD9E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00A9E89D
                                                  • GetLastError.KERNEL32 ref: 00A9E8A7
                                                  • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00A9E945
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                  • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                  • API String ID: 213125376-288575659
                                                  • Opcode ID: 6e5ac746a69a55d610bf8c64801b56f1c056fd5fcc04eb19f310b2f4e73c63f0
                                                  • Instruction ID: fa61441f8bfee7dc72c2a810a8ea837f5415d088d55d3cdeb7b867b46e3146f3
                                                  • Opcode Fuzzy Hash: 6e5ac746a69a55d610bf8c64801b56f1c056fd5fcc04eb19f310b2f4e73c63f0
                                                  • Instruction Fuzzy Hash: E3418172A00225ABDF20DBE5DD45EDABFF8FF08750F114126F905BB251DB3199418BA0
                                                  Function 00AAC774 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to copy install arguments for passthrough bundle package, xrefs: 00AACA62
                                                  • pseudobundle.cpp, xrefs: 00AAC7A8, 00AAC9A1, 00AAC9DB
                                                  • Failed to allocate memory for pseudo bundle payload hash., xrefs: 00AAC9AD
                                                  • Failed to copy local source path for passthrough pseudo bundle., xrefs: 00AAC9B7
                                                  • Failed to copy filename for passthrough pseudo bundle., xrefs: 00AAC9BE
                                                  • Failed to copy cache id for passthrough pseudo bundle., xrefs: 00AACA05
                                                  • Failed to copy related arguments for passthrough bundle package, xrefs: 00AACA82
                                                  • Failed to copy key for passthrough pseudo bundle payload., xrefs: 00AAC9C5
                                                  • Failed to copy download source for passthrough pseudo bundle., xrefs: 00AAC98F
                                                  • Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00AACAAC
                                                  • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00AAC9E7
                                                  • Failed to recreate command-line arguments., xrefs: 00AACA43
                                                  • Failed to copy key for passthrough pseudo bundle., xrefs: 00AAC988
                                                  • Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00AAC7B4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateProcess
                                                  • String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
                                                  • API String ID: 1357844191-115096447
                                                  • Opcode ID: 06ec4c6e966795b7830b18ddaed38c50b3d8c45dbf4a99ecbccb265cf718ee2b
                                                  • Instruction ID: b01d40e0781dc72e635935c49939adbacc0914e6130e65ffcafecffe4f028261
                                                  • Opcode Fuzzy Hash: 06ec4c6e966795b7830b18ddaed38c50b3d8c45dbf4a99ecbccb265cf718ee2b
                                                  • Instruction Fuzzy Hash: 5BB17936A00606EFDB12DF28C881F56BBB1BF09720F158669FD15AB391CB71E811DB80
                                                  Function 00AADE46 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 00AADE61
                                                  Strings
                                                  • Falied to start BITS job., xrefs: 00AAE019
                                                  • Failed to initialize BITS job callback., xrefs: 00AADF82
                                                  • Failed to create BITS job callback., xrefs: 00AADF74
                                                  • bitsuser.cpp, xrefs: 00AADE77, 00AADF6A
                                                  • Failed to set callback interface for BITS job., xrefs: 00AADF99
                                                  • Failed to download BITS job., xrefs: 00AADFF8
                                                  • Failed to set credentials for BITS job., xrefs: 00AADF0F
                                                  • Failed to create BITS job., xrefs: 00AADEF0
                                                  • Failed while waiting for BITS download., xrefs: 00AAE012
                                                  • Invalid BITS user URL: %ls, xrefs: 00AADE83
                                                  • Failed to copy download URL., xrefs: 00AADEA8
                                                  • Failed to complete BITS job., xrefs: 00AAE00B
                                                  • Failed to add file to BITS job., xrefs: 00AADF2E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen
                                                  • String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS user URL: %ls$bitsuser.cpp
                                                  • API String ID: 1659193697-2382896028
                                                  • Opcode ID: 7b84f96c2758193ecdb07bd4cd0e24b5f82ea40c56bc78fd9b24fc7535ac552d
                                                  • Instruction ID: 450ebca3e985c5413a5841eb2b182c39d94f0c5d2a5afa401755432af21120dc
                                                  • Opcode Fuzzy Hash: 7b84f96c2758193ecdb07bd4cd0e24b5f82ea40c56bc78fd9b24fc7535ac552d
                                                  • Instruction Fuzzy Hash: 5661F631A40225FFCB21DF98C985E6E7BB4EF0AB20B224556FC05AF291D7B1DD409B90
                                                  Function 00A8BC93 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 190processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8BCE5
                                                  • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 00A8BDF2
                                                  • GetLastError.KERNEL32(?,?,?,?), ref: 00A8BDFC
                                                  • WaitForInputIdle.USER32(?,?), ref: 00A8BE50
                                                  • CloseHandle.KERNEL32(?,?,?), ref: 00A8BE9B
                                                  • CloseHandle.KERNEL32(?,?,?), ref: 00A8BEA8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
                                                  • String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
                                                  • API String ID: 155678114-2737401750
                                                  • Opcode ID: 76118c8b2090cd4a76f7688977281fcd01b599f1ae00bf8b218dae5489f8aa52
                                                  • Instruction ID: 86efe35fba86f87fd7f356d58e98fa45d1d17bb14a675d50d08cae00e040eaed
                                                  • Opcode Fuzzy Hash: 76118c8b2090cd4a76f7688977281fcd01b599f1ae00bf8b218dae5489f8aa52
                                                  • Instruction Fuzzy Hash: 80515B72D0061ABFCF11AFD4CD42EEEBB79BF04310B15456AFA14B6120E7319E519BA1
                                                  Function 00AA69D2 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 153serviceCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00AA6F28,?), ref: 00AA6A0B
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00AA6F28,?,?,?), ref: 00AA6A18
                                                  • OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00AA6F28,?,?,?), ref: 00AA6A60
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00AA6F28,?,?,?), ref: 00AA6A6C
                                                  • QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00AA6F28,?,?,?), ref: 00AA6AA6
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00AA6F28,?,?,?), ref: 00AA6AB0
                                                  • CloseServiceHandle.ADVAPI32(00000000), ref: 00AA6B67
                                                  • CloseServiceHandle.ADVAPI32(?), ref: 00AA6B71
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
                                                  • String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuuser.cpp$wuauserv
                                                  • API String ID: 971853308-301359130
                                                  • Opcode ID: 611296e81afeca1904a35fc3d43f569ac533d94e23476e004da60e63ba804174
                                                  • Instruction ID: 96f3668d30f7acf0703f495ee3ceed319184b44b562d6d882dad1f15b08ca679
                                                  • Opcode Fuzzy Hash: 611296e81afeca1904a35fc3d43f569ac533d94e23476e004da60e63ba804174
                                                  • Instruction Fuzzy Hash: 9841A976E80325ABDB11DBA8CD45EAEB7B8AB05750F1A8425FD01F7281D775DC018EB0
                                                  Function 00A93B4E Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 130COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00A93BA2
                                                  • GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00A93BAC
                                                  • GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00A93C15
                                                  • ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00A93C1C
                                                  • CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00A93CA6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
                                                  • String ID: 4#v$%u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
                                                  • API String ID: 2407829081-4287186919
                                                  • Opcode ID: 3c0ccb048f630f19cae9a8f9371c6e57025fcc47f71e30c131b7cc83e9bc6808
                                                  • Instruction ID: 8bb3b71fe08de4a22e12a18ff02a6bf207721e3b65a9ddaf42cb7e6e2721d1a4
                                                  • Opcode Fuzzy Hash: 3c0ccb048f630f19cae9a8f9371c6e57025fcc47f71e30c131b7cc83e9bc6808
                                                  • Instruction Fuzzy Hash: 5A417073E8163DAACF209B54CD49FDA77B8AB14710F1106A1F919B7280DB709F858BD1
                                                  Function 00A8A28B Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8A2B3
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8A30E
                                                  • RegQueryValueExW.ADVAPI32(000002C0,00000100,00000000,000002C0,00000000,00000000,000002C0,?,00000100,00000000,?,00000000,?,000002C0,000002C0,?), ref: 00A8A32F
                                                  • RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,00000100,00000000,000002C0), ref: 00A8A405
                                                  Strings
                                                  • Registry key not found. Key = '%ls', xrefs: 00A8A396
                                                  • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00A8A37A
                                                  • Failed to query registry key value., xrefs: 00A8A36A
                                                  • search.cpp, xrefs: 00A8A360
                                                  • Failed to format key string., xrefs: 00A8A2BE
                                                  • Failed to open registry key. Key = '%ls', xrefs: 00A8A3C7
                                                  • Failed to format value string., xrefs: 00A8A319
                                                  • RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00A8A3DD
                                                  • Failed to set variable., xrefs: 00A8A3BD
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16$CloseQueryValue
                                                  • String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
                                                  • API String ID: 2702208347-46557908
                                                  • Opcode ID: e0b07f5664389e23bcfa21410565bcd7b28f9d3c8b5160090cdd7a7d1f5234a7
                                                  • Instruction ID: 7e668ee515386aad41a68591e107591c511f22b95054d4071f62d7ec89e5bdbf
                                                  • Opcode Fuzzy Hash: e0b07f5664389e23bcfa21410565bcd7b28f9d3c8b5160090cdd7a7d1f5234a7
                                                  • Instruction Fuzzy Hash: 8F41E736D00124FBEF22BB98CD06FEEBA68EB14710F114266F914BA152D7319E10AB91
                                                  Function 00A8B208 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 137COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,00A8BAFB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B210
                                                  • GetLastError.KERNEL32(?,00A8BAFB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00A8B21C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorHandleLastModule
                                                  • String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
                                                  • API String ID: 4242514867-926796631
                                                  • Opcode ID: b4134f8602aca3c0c59deb6f6812c698ae316103cadb0eb0b1708689fd12bf89
                                                  • Instruction ID: a391ececb76eda7a9ac27406e5b91f8f4ccec5f24fd712f8aca13013f20936eb
                                                  • Opcode Fuzzy Hash: b4134f8602aca3c0c59deb6f6812c698ae316103cadb0eb0b1708689fd12bf89
                                                  • Instruction Fuzzy Hash: 59411732290720B7CB207B459C46FAE2655FB95F71F26882DF9016F182E775C90293F9
                                                  Function 00A8694B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 133libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00A8699B
                                                  • GetLastError.KERNEL32 ref: 00A869A5
                                                  • GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00A869E8
                                                  • GetLastError.KERNEL32 ref: 00A869F2
                                                  • FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00A86B03
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
                                                  • String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
                                                  • API String ID: 3057421322-109962352
                                                  • Opcode ID: a106f818eec129e434a5d329493b8a85146ebc4cbea42575232cda8614aadd3a
                                                  • Instruction ID: dd2f6cfa23a4c483b3a69c6004df0dd4603e47ff9db74db425b54d42f7cf36d9
                                                  • Opcode Fuzzy Hash: a106f818eec129e434a5d329493b8a85146ebc4cbea42575232cda8614aadd3a
                                                  • Instruction Fuzzy Hash: 5541D672D41239ABEB25EB64CC05FEABBB4FB08750F014599E948B7180E7758E40CBA0
                                                  Function 00A848EF Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130memorysynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00A85466,?,?,?,?), ref: 00A84920
                                                  • GetLastError.KERNEL32(?,?,?,00A85466,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00A84931
                                                  • ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A84A6E
                                                  • CloseHandle.KERNEL32(?,?,?,?,00A85466,?,?,?,?,?,?,?,?,?,?,?), ref: 00A84A77
                                                  Strings
                                                  • Failed to set elevated pipe into thread local storage for logging., xrefs: 00A849A8
                                                  • user.cpp, xrefs: 00A84955, 00A8499E
                                                  • comres.dll, xrefs: 00A849DD
                                                  • Failed to pump messages from parent process., xrefs: 00A84A42
                                                  • Failed to allocate thread local storage for logging., xrefs: 00A8495F
                                                  • Failed to create the message window., xrefs: 00A849CC
                                                  • Failed to connect to unelevated process., xrefs: 00A84916
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AllocCloseErrorHandleLastMutexRelease
                                                  • String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$user.cpp
                                                  • API String ID: 687263955-1790235126
                                                  • Opcode ID: 71f904e191479eabd6d5bd3f9d3ffc1eea50ac65794c2f7f91a432b3b46d1904
                                                  • Instruction ID: a5dc7b7dbae351c27ca5eb752f33f08e4d140f6f9435dfbf1aee0ed6a5c990ca
                                                  • Opcode Fuzzy Hash: 71f904e191479eabd6d5bd3f9d3ffc1eea50ac65794c2f7f91a432b3b46d1904
                                                  • Instruction Fuzzy Hash: A741A873A40616BBC725EBA4CC46FDFFA6CBF08750F02061AFA15A7150DB71A91087E4
                                                  Function 00A87FA5 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 216COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000,00000000,00000000,00000001,00000000,00000002,000000B9), ref: 00A87FC2
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00A881EA
                                                  Strings
                                                  • Failed to write variable name., xrefs: 00A881D1
                                                  • Failed to write variable value as string., xrefs: 00A881AE
                                                  • Failed to get numeric., xrefs: 00A881BC
                                                  • Failed to write variable count., xrefs: 00A87FDD
                                                  • feclient.dll, xrefs: 00A8809D, 00A880F3, 00A88134
                                                  • Failed to get version., xrefs: 00A8819B
                                                  • Failed to get string., xrefs: 00A881B5
                                                  • Failed to write included flag., xrefs: 00A881D8
                                                  • Failed to write variable value as number., xrefs: 00A88194
                                                  • Failed to write literal flag., xrefs: 00A881C3
                                                  • Unsupported variable type., xrefs: 00A881A7
                                                  • Failed to write variable value type., xrefs: 00A881CA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
                                                  • API String ID: 3168844106-2118673349
                                                  • Opcode ID: 41bb45c6524cd7d96ce4468fb3c85fa13ecb68f1249b05f1c5330c060c841039
                                                  • Instruction ID: 7d5affebb20788cfd2f4d2430d9ec72e09f0610b6703cd15006bc02f59aa99e0
                                                  • Opcode Fuzzy Hash: 41bb45c6524cd7d96ce4468fb3c85fa13ecb68f1249b05f1c5330c060c841039
                                                  • Instruction Fuzzy Hash: E1719F32D0062AAFCB12AFA8CD45FAEBBB9BF04350F514625E90167151CF389D169B90
                                                  Function 00A997B2 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,00A9A843,00000000,00000000,00000000,?,00000000), ref: 00A997CD
                                                  • GetLastError.KERNEL32(?,00A9A843,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00A997DD
                                                    • Part of subcall function 00AC4102: Sleep.KERNEL32(?,00000000,?,00A985EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00A84DBC), ref: 00AC4119
                                                  • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 00A998E9
                                                  Strings
                                                  • Moving, xrefs: 00A9987F
                                                  • Failed to move %ls to %ls, xrefs: 00A998C1
                                                  • cache.cpp, xrefs: 00A99801
                                                  • %ls payload from working path '%ls' to path '%ls', xrefs: 00A99894
                                                  • Failed to open payload in working path: %ls, xrefs: 00A9980C
                                                  • Failed to verify payload signature: %ls, xrefs: 00A99838
                                                  • Copying, xrefs: 00A99888, 00A99893
                                                  • Failed to copy %ls to %ls, xrefs: 00A998D7
                                                  • Failed to verify payload hash: %ls, xrefs: 00A99875
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLastSleep
                                                  • String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
                                                  • API String ID: 1275171361-1604654059
                                                  • Opcode ID: e9971caa322e3d48b5d2b0f56590bef8860ab496b70ff29300bd7501924e5155
                                                  • Instruction ID: 84fb79122ec74840951e60fb510d515332c01df4f93959cd1a93e8702a2460f6
                                                  • Opcode Fuzzy Hash: e9971caa322e3d48b5d2b0f56590bef8860ab496b70ff29300bd7501924e5155
                                                  • Instruction Fuzzy Hash: 5F31B472B40670BBDF326A5D8C4AF6F3AACEF46B50F02415DFE057B281E6619D0096E1
                                                  Function 00A865C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000000), ref: 00A865FC
                                                    • Part of subcall function 00AC0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00A85EB2,00000000), ref: 00AC0AE0
                                                    • Part of subcall function 00AC0ACC: GetProcAddress.KERNEL32(00000000), ref: 00AC0AE7
                                                    • Part of subcall function 00AC0ACC: GetLastError.KERNEL32(?,?,?,00A85EB2,00000000), ref: 00AC0AFE
                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A86628
                                                  • GetLastError.KERNEL32 ref: 00A86636
                                                  • GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 00A8666E
                                                  • GetLastError.KERNEL32 ref: 00A86678
                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00A866BB
                                                  • GetLastError.KERNEL32 ref: 00A866C5
                                                  Strings
                                                  • variable.cpp, xrefs: 00A8665A, 00A8669C
                                                  • Failed to backslash terminate system folder., xrefs: 00A86708
                                                  • Failed to get 64-bit system folder., xrefs: 00A86664
                                                  • Failed to set system folder variant value., xrefs: 00A86724
                                                  • Failed to get 32-bit system folder., xrefs: 00A866A6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
                                                  • String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
                                                  • API String ID: 325818893-1590374846
                                                  • Opcode ID: 677ff5611cf8cf00b9eb857ee803ab7af82b070ea6423bec69b614a99e03d396
                                                  • Instruction ID: 714d40f4e95b2b4abdd514d9012320b00da0cbedf24fe28d0d2a9c385a2ce184
                                                  • Opcode Fuzzy Hash: 677ff5611cf8cf00b9eb857ee803ab7af82b070ea6423bec69b614a99e03d396
                                                  • Instruction Fuzzy Hash: 1231F573D41239A7EB20B7A58D49F9A77A8AF00760F164575BD04BB180EB74DD408BE1
                                                  Function 00A93F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A93AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00A93FB5,feclient.dll,?,00000000,?,?,?,00A84B12), ref: 00A93B42
                                                  • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00A84B12,?,?,00ACB488,?,00000001,00000000,00000000), ref: 00A9404C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseSleep
                                                  • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                  • API String ID: 2834455192-2673269691
                                                  • Opcode ID: 7785901b21ee6d505fa01034546b1b63a01a0bcfa7abb28dd2c09a547e7b793c
                                                  • Instruction ID: f0e1d004ef33338c7510dc19171e92cc0d75d2b26ddf58659ede78970e109a5d
                                                  • Opcode Fuzzy Hash: 7785901b21ee6d505fa01034546b1b63a01a0bcfa7abb28dd2c09a547e7b793c
                                                  • Instruction Fuzzy Hash: C261E271B00616BADF219F28CD42F7A7BF8EF18340B154229F901DB250EB71EE918791
                                                  Function 00A86DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000001,?,00000000,00A85445,00000006,?,00A882B9,?,?,?,00000000,00000000,00000001), ref: 00A86DC8
                                                    • Part of subcall function 00A856A9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00A86595,00A86595,?,00A8563D,?,?,00000000), ref: 00A856E5
                                                    • Part of subcall function 00A856A9: GetLastError.KERNEL32(?,00A8563D,?,?,00000000,?,?,00A86595,?,00A87F02,?,?,?,?,?), ref: 00A85714
                                                  • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,00A882B9), ref: 00A86F59
                                                  Strings
                                                  • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00A86ED0
                                                  • Setting hidden variable '%ls', xrefs: 00A86E86
                                                  • variable.cpp, xrefs: 00A86E4B
                                                  • Attempt to set built-in variable value: %ls, xrefs: 00A86E56
                                                  • Failed to insert variable '%ls'., xrefs: 00A86E0D
                                                  • Failed to set value of variable: %ls, xrefs: 00A86F41
                                                  • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00A86F6B
                                                  • Failed to find variable value '%ls'., xrefs: 00A86DE3
                                                  • Setting string variable '%ls' to value '%ls', xrefs: 00A86EED
                                                  • Unsetting variable '%ls', xrefs: 00A86F15
                                                  • Setting numeric variable '%ls' to value %lld, xrefs: 00A86EFA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                  • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                  • API String ID: 2716280545-445000439
                                                  • Opcode ID: 5f2e3fab3930cc05b7a7dd656671dfa1394e554fe481f1cd1be590675c13e7dc
                                                  • Instruction ID: e1cfb0c7ed6ee0402279da8bb4536c0c830d61694184b91fb3181c95ce50dbb3
                                                  • Opcode Fuzzy Hash: 5f2e3fab3930cc05b7a7dd656671dfa1394e554fe481f1cd1be590675c13e7dc
                                                  • Instruction Fuzzy Hash: 2C51F371A40225FBEB30BF19CD4AF6B3BA8EB55714F11052DF9486A282C271ED41CBE1
                                                  Function 00A92C1C Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 299COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00A92C8A
                                                  Strings
                                                  • Failed to add dependents ignored from command-line., xrefs: 00A92D3F
                                                  • crypt32.dll, xrefs: 00A92CD5, 00A92DCF, 00A92EC4, 00A92F39
                                                  • Failed to add self-dependent to ignore dependents., xrefs: 00A92D0E
                                                  • Failed to add registration action for self dependent., xrefs: 00A92F57
                                                  • Failed to add registration action for dependent related bundle., xrefs: 00A92F8E
                                                  • Failed to create the string dictionary., xrefs: 00A92CC3
                                                  • wininet.dll, xrefs: 00A92ED7
                                                  • Failed to check for remaining dependents during planning., xrefs: 00A92E30
                                                  • Failed to add dependent bundle provider key to ignore dependents., xrefs: 00A92DF4
                                                  • Failed to allocate registration action., xrefs: 00A92CF3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
                                                  • API String ID: 1825529933-1705955799
                                                  • Opcode ID: c22d8f1d5fa9b8bac1b690bbc9b6d7ac2195e4c0240cdbce669aa9dcb6e82ee0
                                                  • Instruction ID: 248e07588a29e135b19bf8525ae39a68f44cb6498d5679f93c89b3acb4807872
                                                  • Opcode Fuzzy Hash: c22d8f1d5fa9b8bac1b690bbc9b6d7ac2195e4c0240cdbce669aa9dcb6e82ee0
                                                  • Instruction Fuzzy Hash: A9B14771A00226FFDF299F68C981BAEBBF5BF04710F00816AF815AA251D730D960CB91
                                                  Function 00A9F90B Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 187COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00A9F947
                                                  • UuidCreate.RPCRT4(?), ref: 00A9FA2A
                                                  • StringFromGUID2.OLE32(?,?,00000027), ref: 00A9FA4B
                                                  • LeaveCriticalSection.KERNEL32(?,?), ref: 00A9FAF4
                                                  Strings
                                                  • update\%ls, xrefs: 00A9F9A3
                                                  • Failed to create bundle update guid., xrefs: 00A9FA37
                                                  • userForApplication.cpp, xrefs: 00A9FA60
                                                  • Failed to set update bundle., xrefs: 00A9FACE
                                                  • Failed to default local update source, xrefs: 00A9F9B7
                                                  • Failed to convert bundle update guid into string., xrefs: 00A9FA6A
                                                  • Failed to recreate command-line for update bundle., xrefs: 00A9FA12
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$CreateEnterFromLeaveStringUuid
                                                  • String ID: userForApplication.cpp$Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
                                                  • API String ID: 171215650-2594647487
                                                  • Opcode ID: c039bcaea80d7f0f7847d1ea416fdc3612c9af9d46a5e336db72c0eb9dd668cf
                                                  • Instruction ID: ccc5a469aa06e0b57efb98d5fa46edb1290f5af09002eed2d4c0743fb133b765
                                                  • Opcode Fuzzy Hash: c039bcaea80d7f0f7847d1ea416fdc3612c9af9d46a5e336db72c0eb9dd668cf
                                                  • Instruction Fuzzy Hash: 5F615831A40215AFCF219FA4C945FAEBBF8EB18760F15417AF809EB252D7719850CB91
                                                  Function 00A84AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • IsWindow.USER32(?), ref: 00A84C64
                                                  • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A84C75
                                                  Strings
                                                  • Failed to check global conditions, xrefs: 00A84B49
                                                  • Failed to open log., xrefs: 00A84B18
                                                  • Failed to set layout directory variable to value provided from command-line., xrefs: 00A84C06
                                                  • Failed to set registration variables., xrefs: 00A84BDE
                                                  • Failed to query registration., xrefs: 00A84BAE
                                                  • Failed to set action variables., xrefs: 00A84BC4
                                                  • WixBundleLayoutDirectory, xrefs: 00A84BF5
                                                  • Failed to create the message window., xrefs: 00A84B98
                                                  • Failed while running , xrefs: 00A84C2A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: MessagePostWindow
                                                  • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                  • API String ID: 3618638489-3051724725
                                                  • Opcode ID: 7edcfb2e6b4a1725500cbf028f8866865a17b366f8c0bb235e3126cd5aecf41a
                                                  • Instruction ID: a2c4a5fa229e7483a9e35622bc392f29434548bb01b778d8288b0337a9090b77
                                                  • Opcode Fuzzy Hash: 7edcfb2e6b4a1725500cbf028f8866865a17b366f8c0bb235e3126cd5aecf41a
                                                  • Instruction Fuzzy Hash: A9410A71A0162BBBCF16BB64CD46FBAB6ACFF08750F010625F815A6150EB71ED1097E0
                                                  Function 00A9F051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 00A9F06E
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00A9F19B
                                                  Strings
                                                  • Failed to copy the arguments., xrefs: 00A9F12D
                                                  • UX requested unknown approved exe with id: %ls, xrefs: 00A9F0CE
                                                  • userForApplication.cpp, xrefs: 00A9F17C
                                                  • Failed to copy the id., xrefs: 00A9F100
                                                  • user is active, cannot change user state., xrefs: 00A9F089
                                                  • Failed to post launch approved exe message., xrefs: 00A9F186
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalHeapSection$AllocateEnterLeaveProcess
                                                  • String ID: user is active, cannot change user state.$userForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
                                                  • API String ID: 1367039788-528931743
                                                  • Opcode ID: 08979d7445c1f2e38464dcfc731eb10c44883f38341519319138bd916bdfbb69
                                                  • Instruction ID: 20b67d5e73834f87432ae7157aa6dcbc9339c8b193718c7b709eaa8694909be4
                                                  • Opcode Fuzzy Hash: 08979d7445c1f2e38464dcfc731eb10c44883f38341519319138bd916bdfbb69
                                                  • Instruction Fuzzy Hash: 1D31A232B50225EFDF21AF68DD05E6A77E8AF04720B254665BE05EB251EB71DD0087E0
                                                  Function 00A9969D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,00A9A7D4,00000000,00000000,00000000,?,00000000), ref: 00A996B8
                                                  • GetLastError.KERNEL32(?,00A9A7D4,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00A996C6
                                                    • Part of subcall function 00AC4102: Sleep.KERNEL32(?,00000000,?,00A985EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00A84DBC), ref: 00AC4119
                                                  • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 00A997A4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLastSleep
                                                  • String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
                                                  • API String ID: 1275171361-1187406825
                                                  • Opcode ID: 45693f1b7ec1fb3493ab5fd6e3b1ef5bac9dcec8f0a654bfabf0fa0a1512fc1b
                                                  • Instruction ID: 9023401f53c018079fac44ed1583205413847f6dc82a7d3571becd694204f846
                                                  • Opcode Fuzzy Hash: 45693f1b7ec1fb3493ab5fd6e3b1ef5bac9dcec8f0a654bfabf0fa0a1512fc1b
                                                  • Instruction Fuzzy Hash: 1F212832B40234BBDB221A9C8C47FAF369CEF41B50F110119FE05BE2C1EA629D0186E5
                                                  Function 00A86F85 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00A86FB2
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00A871BE
                                                  Strings
                                                  • Failed to read variable value type., xrefs: 00A871A0
                                                  • Failed to set variable value., xrefs: 00A87171
                                                  • Failed to read variable value as string., xrefs: 00A8718B
                                                  • Failed to read variable included flag., xrefs: 00A871AE
                                                  • Failed to read variable literal flag., xrefs: 00A87199
                                                  • Failed to read variable name., xrefs: 00A871A7
                                                  • Failed to read variable value as number., xrefs: 00A87178
                                                  • Failed to set variable., xrefs: 00A87192
                                                  • Failed to read variable count., xrefs: 00A86FD2
                                                  • Unsupported variable type., xrefs: 00A87184
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
                                                  • API String ID: 3168844106-528957463
                                                  • Opcode ID: c78a293d725ce0f72f32139bb889a45bf7eddb7eebaf35aa9dc3bb45dce590c3
                                                  • Instruction ID: 3788a190a32c9b5b1ea6429b5a562bdf7eb2bfd1590bffd84c55aa15cf346dd4
                                                  • Opcode Fuzzy Hash: c78a293d725ce0f72f32139bb889a45bf7eddb7eebaf35aa9dc3bb45dce590c3
                                                  • Instruction Fuzzy Hash: 71717E72C0425ABBDF12EFA4CD49FAEBBB9EB00750F254625F900A6560D731DE109BA0
                                                  Function 00AC44D1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00AC4550
                                                  • GetLastError.KERNEL32 ref: 00AC4566
                                                  • GetFileSizeEx.KERNEL32(00000000,?), ref: 00AC45BF
                                                  • GetLastError.KERNEL32 ref: 00AC45C9
                                                  • SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00AC461D
                                                  • GetLastError.KERNEL32 ref: 00AC4628
                                                  • ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00AC4717
                                                  • CloseHandle.KERNEL32(?), ref: 00AC478A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 3286166115-2967768451
                                                  • Opcode ID: 1ec8db270fcef1b7d07eb0334072227f4320f0d38a2a51a8915ba3eaf3cca6d1
                                                  • Instruction ID: d6ae6dc33c6c6126ecc2b5a5095eaa3bf1db19c6791aa0f6951308ea21a25bd4
                                                  • Opcode Fuzzy Hash: 1ec8db270fcef1b7d07eb0334072227f4320f0d38a2a51a8915ba3eaf3cca6d1
                                                  • Instruction Fuzzy Hash: BF812676A0022AEBDB218F598C65FAE76A8AF09760F13411DFD55EB280D774CD008BD8
                                                  Function 00A83076 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 00A830C1
                                                  • GetLastError.KERNEL32 ref: 00A830C7
                                                  • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00A83121
                                                  • GetLastError.KERNEL32 ref: 00A83127
                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A831DB
                                                  • GetLastError.KERNEL32 ref: 00A831E5
                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A8323B
                                                  • GetLastError.KERNEL32 ref: 00A83245
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
                                                  • String ID: @$pathutil.cpp
                                                  • API String ID: 1547313835-3022285739
                                                  • Opcode ID: 701ac9565fdf519339ce7d45149542da43f611fc6b7fe7c923e46c560c060087
                                                  • Instruction ID: 5814973c37e8a17d791247d486b1acfcc5dba71ea74d49279dc66948917e9bce
                                                  • Opcode Fuzzy Hash: 701ac9565fdf519339ce7d45149542da43f611fc6b7fe7c923e46c560c060087
                                                  • Instruction Fuzzy Hash: 0E618173D01229ABDF21ABE58945BDEBAB8AF14F50F124255EE00BB250E7759F0087E0
                                                  Function 00A82DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00A82E5F
                                                  • GetLastError.KERNEL32 ref: 00A82E69
                                                  • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00A82F09
                                                  • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00A82F96
                                                  • GetLastError.KERNEL32 ref: 00A82FA3
                                                  • Sleep.KERNEL32(00000064), ref: 00A82FB7
                                                  • CloseHandle.KERNEL32(?), ref: 00A8301F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                  • String ID: 4#v$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                  • API String ID: 3480017824-1777530710
                                                  • Opcode ID: ac10c0b18c4e15fe8f0a5bda9fe6ddca55987749eef1879b2a6aa0bbc4dc364c
                                                  • Instruction ID: a2fdd67ae7720b3970d27d9c4823ba2d66fe5aba8f8d463032f5fb92f6ca011e
                                                  • Opcode Fuzzy Hash: ac10c0b18c4e15fe8f0a5bda9fe6ddca55987749eef1879b2a6aa0bbc4dc364c
                                                  • Instruction Fuzzy Hash: E4718572D41129ABDB31AFA8DD49BAEB7B8AB08710F0141D5FA44E7190D7349E81CF64
                                                  Function 00AC6D50 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 165COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7622DFD0,?,00AC72C8,?,?), ref: 00AC6DA6
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6E11
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6E89
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6EC8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Free$Compare
                                                  • String ID: `Dv$label$scheme$term
                                                  • API String ID: 1324494773-22456348
                                                  • Opcode ID: a0e0092e7d6d6ad8d0d7e22d1c2aa2706136f7a252af9064f2269076a5a3481d
                                                  • Instruction ID: 78549a740c3715640ad95e2a7a649e79ea5832c8d492438419bd2764ed1671ee
                                                  • Opcode Fuzzy Hash: a0e0092e7d6d6ad8d0d7e22d1c2aa2706136f7a252af9064f2269076a5a3481d
                                                  • Instruction Fuzzy Hash: AD515E39901219FBCF15DB98CD45FAEBBB8EF04711F2642A9F511AB2A0DB319E00DB50
                                                  Function 00A94D8D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • UuidCreate.RPCRT4(?), ref: 00A94DC0
                                                  • StringFromGUID2.OLE32(?,?,00000027), ref: 00A94DEF
                                                  • UuidCreate.RPCRT4(?), ref: 00A94E3A
                                                  • StringFromGUID2.OLE32(?,?,00000027), ref: 00A94E66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateFromStringUuid
                                                  • String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
                                                  • API String ID: 4041566446-2510341293
                                                  • Opcode ID: 36b57f656feb066fcbf0c39a8175015955958eaaad6d13ac3ac6e1ed19ce0fef
                                                  • Instruction ID: b077a410758b7f2a3ee325de1c993c529a9e8580d51eb4ad69b41e8edadac1e3
                                                  • Opcode Fuzzy Hash: 36b57f656feb066fcbf0c39a8175015955958eaaad6d13ac3ac6e1ed19ce0fef
                                                  • Instruction Fuzzy Hash: B0416F76E40308ABDF11EBE4CD45EDEB7F8AB48710F214526F905BB240D7759946CB90
                                                  Function 00A9EA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00A8548E,?,?), ref: 00A9EA9D
                                                  • GetLastError.KERNEL32(?,00A8548E,?,?), ref: 00A9EAAA
                                                  • CreateThread.KERNEL32(00000000,00000000,00A9E7B4,?,00000000,00000000), ref: 00A9EB03
                                                  • GetLastError.KERNEL32(?,00A8548E,?,?), ref: 00A9EB10
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00A8548E,?,?), ref: 00A9EB4B
                                                  • CloseHandle.KERNEL32(00000000,?,00A8548E,?,?), ref: 00A9EB6A
                                                  • CloseHandle.KERNEL32(?,?,00A8548E,?,?), ref: 00A9EB77
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                  • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                  • API String ID: 2351989216-3599963359
                                                  • Opcode ID: 379138f46115b17a538074e8a58dc355fa14680950a7f968285100bcb90d627e
                                                  • Instruction ID: 50169469e06f44991abf6c395ac9e69bd18c80b9f66f1e6dbf66c762730be387
                                                  • Opcode Fuzzy Hash: 379138f46115b17a538074e8a58dc355fa14680950a7f968285100bcb90d627e
                                                  • Instruction Fuzzy Hash: 36316176E01229BBDB10DFD98D85A9FBBFCBB04750F114566B905F7241E6309E008AA1
                                                  Function 00A9E645 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00A8548E,?,?), ref: 00A9E666
                                                  • GetLastError.KERNEL32(?,?,00A8548E,?,?), ref: 00A9E673
                                                  • CreateThread.KERNEL32(00000000,00000000,00A9E3C8,00000000,00000000,00000000), ref: 00A9E6D2
                                                  • GetLastError.KERNEL32(?,?,00A8548E,?,?), ref: 00A9E6DF
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00A8548E,?,?), ref: 00A9E71A
                                                  • CloseHandle.KERNEL32(?,?,?,00A8548E,?,?), ref: 00A9E72E
                                                  • CloseHandle.KERNEL32(?,?,?,00A8548E,?,?), ref: 00A9E73B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                  • String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
                                                  • API String ID: 2351989216-1977201954
                                                  • Opcode ID: b413b408e0a188769f9e249240cb365e032ed4ca24918550f3429f425c744c8b
                                                  • Instruction ID: 33e9f3fba7310b6c56819cb753a2a9bd7266f7756162eccd02f5e73138929030
                                                  • Opcode Fuzzy Hash: b413b408e0a188769f9e249240cb365e032ed4ca24918550f3429f425c744c8b
                                                  • Instruction Fuzzy Hash: 2D318176E00229BBDB21DBD9DC05EAFBBF8AB54710F114566FE11F7241E7309A018AA1
                                                  Function 00AA14E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,76232F60,?,?,00A85405,00A853BD,00000000,00A85445), ref: 00AA1506
                                                  • GetLastError.KERNEL32 ref: 00AA1519
                                                  • GetExitCodeThread.KERNEL32(00ACB488,?), ref: 00AA155B
                                                  • GetLastError.KERNEL32 ref: 00AA1569
                                                  • ResetEvent.KERNEL32(00ACB460), ref: 00AA15A4
                                                  • GetLastError.KERNEL32 ref: 00AA15AE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                  • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                  • API String ID: 2979751695-3400260300
                                                  • Opcode ID: 3c9632dee17532e7c336814a0570bcdcd09268596e2da8e0ae5ab1821ad3fcc5
                                                  • Instruction ID: 8c427d35ba62da2b06ea0fc45351728889ee9a858ccf40e8e2f4ad147ee52677
                                                  • Opcode Fuzzy Hash: 3c9632dee17532e7c336814a0570bcdcd09268596e2da8e0ae5ab1821ad3fcc5
                                                  • Instruction Fuzzy Hash: 22319371E40306FBDB10DFA98D06AAE7BF8FB45710F10456AF906D72A0E731DA019B65
                                                  Function 00AA15FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetEvent.KERNEL32(00ACB478,?,00000000,?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000,?), ref: 00AA161B
                                                  • GetLastError.KERNEL32(?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000,?,00A85489,FFF9E89D,00A85489), ref: 00AA1625
                                                  • WaitForSingleObject.KERNEL32(00ACB488,000000FF,?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000,?,00A85489), ref: 00AA165F
                                                  • GetLastError.KERNEL32(?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000,?,00A85489,FFF9E89D,00A85489), ref: 00AA1669
                                                  • CloseHandle.KERNEL32(00000000,00A85489,?,00000000,?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000), ref: 00AA16B4
                                                  • CloseHandle.KERNEL32(00000000,00A85489,?,00000000,?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000), ref: 00AA16C3
                                                  • CloseHandle.KERNEL32(00000000,00A85489,?,00000000,?,00A8C1D3,?,00A853BD,00000000,?,00A9784D,?,00A8566D,00A85479,00A85479,00000000), ref: 00AA16D2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$ErrorLast$EventObjectSingleWait
                                                  • String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
                                                  • API String ID: 1206859064-226982402
                                                  • Opcode ID: 4f8ec44e037dddc80a5ba3fd488c0167ac4e46e6ac846a3c3c05eaafd08371ec
                                                  • Instruction ID: 2cf2c32e3933f20d154e92a446b190563b4a9a4a8e7da99d5406828e926cfc31
                                                  • Opcode Fuzzy Hash: 4f8ec44e037dddc80a5ba3fd488c0167ac4e46e6ac846a3c3c05eaafd08371ec
                                                  • Instruction Fuzzy Hash: 2D217B33500A32BBC7219B65CD09B56B6A4FF05761F0A0225F904A39E0D375EC50CBE9
                                                  Function 00A941EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0523: EnterCriticalSection.KERNEL32(00AEB5FC,00000000,?,?,?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?), ref: 00AC0533
                                                    • Part of subcall function 00AC0523: LeaveCriticalSection.KERNEL32(00AEB5FC,?,?,00AEB5F4,?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?), ref: 00AC067A
                                                  • OpenEventLogW.ADVAPI32(00000000,Application), ref: 00A94212
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00A9421E
                                                  • ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,00AD39D4,00000000), ref: 00A9426B
                                                  • CloseEventLog.ADVAPI32(00000000), ref: 00A94272
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
                                                  • String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
                                                  • API String ID: 1844635321-1389066741
                                                  • Opcode ID: 15fa09f300b6cd31f2ceb09bb101df4f8c9c00bb921ee272e58fdc97cff6c97b
                                                  • Instruction ID: 4d6742d8f5c421e0ed0a1d8b4e796b0d69dda6ac33917e92ce356d024d653307
                                                  • Opcode Fuzzy Hash: 15fa09f300b6cd31f2ceb09bb101df4f8c9c00bb921ee272e58fdc97cff6c97b
                                                  • Instruction Fuzzy Hash: 6AF0F973B412717A5F3123A65C0AEBB2D6CFAC6F21702041ABD11F5240DB508D0340F6
                                                  Function 00A993FE Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 226COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00A9949E
                                                  • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 00A994C6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast
                                                  • String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
                                                  • API String ID: 1452528299-4263581490
                                                  • Opcode ID: c0670e0c4f5b2d8f9414e67583c114a6bfaba1000a55a3cf032f61a073113fb7
                                                  • Instruction ID: a8875c5371ce9ac8db708a591ca7a01c59c662de9beb5556b756aa9b799f6d9b
                                                  • Opcode Fuzzy Hash: c0670e0c4f5b2d8f9414e67583c114a6bfaba1000a55a3cf032f61a073113fb7
                                                  • Instruction Fuzzy Hash: 97715372E00229BBDF21DFD8CD45AEFB7F8AB04750F15012AE915BB281E7359D058BA1
                                                  Function 00A9E56C Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetWindowLongW.USER32(?,000000EB), ref: 00A9E577
                                                  • DefWindowProcW.USER32(?,00000082,?,?), ref: 00A9E5B5
                                                  • SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A9E5C2
                                                  • SetWindowLongW.USER32(?,000000EB,?), ref: 00A9E5D1
                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 00A9E5DF
                                                  • CreateCompatibleDC.GDI32(?), ref: 00A9E5EB
                                                  • SelectObject.GDI32(00000000,00000000), ref: 00A9E5FC
                                                  • StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00A9E61E
                                                  • SelectObject.GDI32(00000000,00000000), ref: 00A9E626
                                                  • DeleteDC.GDI32(00000000), ref: 00A9E629
                                                  • PostQuitMessage.USER32(00000000), ref: 00A9E637
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
                                                  • String ID:
                                                  • API String ID: 409979828-0
                                                  • Opcode ID: 2e2302e26ca3c98efacf8087804c58f470c179b3727d7da6bc3be2acce88f06c
                                                  • Instruction ID: 3c7dee09267dd2f0b0c34a720d10849d461011cb2b6c31807cf485fa72c3fc39
                                                  • Opcode Fuzzy Hash: 2e2302e26ca3c98efacf8087804c58f470c179b3727d7da6bc3be2acce88f06c
                                                  • Instruction Fuzzy Hash: 12217832210244BFDB15DFA8DC0ED7B3BA8FB49361F064518FA169B2B1D7328811DB60
                                                  Function 00A9A13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • WixBundleLastUsedSource, xrefs: 00A9A1A1
                                                  • Failed to combine layout source with source., xrefs: 00A9A2A4
                                                  • WixBundleOriginalSource, xrefs: 00A9A1B7
                                                  • WixBundleLayoutDirectory, xrefs: 00A9A26C
                                                  • Failed to copy source path., xrefs: 00A9A31A
                                                  • Failed to get current process directory., xrefs: 00A9A1F3
                                                  • Failed to get bundle layout directory property., xrefs: 00A9A287
                                                  • Failed to combine last source with source., xrefs: 00A9A210
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Find$CloseFileFirstlstrlen
                                                  • String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
                                                  • API String ID: 2767606509-3003062821
                                                  • Opcode ID: cb4ec1a2cf2fea01995e44428888b04ea601ff4190ec9d819a374bd6094a7940
                                                  • Instruction ID: 2c43b1d150051f6e84e5ef1b06de855243a691c1a4254b2b4160a20a05bf537f
                                                  • Opcode Fuzzy Hash: cb4ec1a2cf2fea01995e44428888b04ea601ff4190ec9d819a374bd6094a7940
                                                  • Instruction Fuzzy Hash: 2B717171E01219AFCF11DFA8D945AEEB7F9AF18310F25052AF911B7260D771AD40CBA2
                                                  Function 00A8CBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,00A853BD,00000000,00A85489,00A85445,WixBundleUILevel,840F01E8,?,00000001), ref: 00A8CC1C
                                                  Strings
                                                  • Failed to concat file paths., xrefs: 00A8CCFC
                                                  • Failed to find embedded payload: %ls, xrefs: 00A8CC48
                                                  • Failed to extract file., xrefs: 00A8CCE7
                                                  • Failed to get directory portion of local file path, xrefs: 00A8CCF5
                                                  • Failed to ensure directory exists, xrefs: 00A8CCEE
                                                  • Payload was not found in container: %ls, xrefs: 00A8CD29
                                                  • payload.cpp, xrefs: 00A8CD1D
                                                  • Failed to get next stream., xrefs: 00A8CD03
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                  • API String ID: 1825529933-1711239286
                                                  • Opcode ID: 6290144b0db8ac70322959f2fa00c245af43825ce53b86782e99a52e1491e5b2
                                                  • Instruction ID: f0e310902ccb8bf60013af5197eecdc7b35ae060574bbcb1553aa862a33fb18f
                                                  • Opcode Fuzzy Hash: 6290144b0db8ac70322959f2fa00c245af43825ce53b86782e99a52e1491e5b2
                                                  • Instruction Fuzzy Hash: 1A41BB71900219EFCF25BF98CD81EAEBBB5BF00720F11816AE915AB251D7709E40DFA0
                                                  Function 00A84796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00A847BB
                                                  • GetCurrentThreadId.KERNEL32 ref: 00A847C1
                                                  • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A8484F
                                                  Strings
                                                  • Failed to create user for UX., xrefs: 00A847DB
                                                  • user.cpp, xrefs: 00A8489B
                                                  • Failed to start bootstrapper application., xrefs: 00A8481D
                                                  • Failed to load UX., xrefs: 00A84804
                                                  • wininet.dll, xrefs: 00A847EE
                                                  • Unexpected return value from message pump., xrefs: 00A848A5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Message$CurrentPeekThread
                                                  • String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$user.cpp$wininet.dll
                                                  • API String ID: 673430819-2573580774
                                                  • Opcode ID: 4d0d2d276206d3993286247d659a3c9629cde90acf792ebb28e5d9b9a3c9eac3
                                                  • Instruction ID: 683d16e4b751bb4e0760def0f8aa5380834c6ec1c3d23029fce9cf5dc39aba41
                                                  • Opcode Fuzzy Hash: 4d0d2d276206d3993286247d659a3c9629cde90acf792ebb28e5d9b9a3c9eac3
                                                  • Instruction Fuzzy Hash: 81417172A00556BFDB14EBA4CC86EBAB7ACFF08314F110529F904E7290DB35AD0587A0
                                                  Function 00AA9C84 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 128COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00AAB03E,?,00000001,00000000), ref: 00AA9D0F
                                                  • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00AAB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00AA9D19
                                                  • CopyFileExW.KERNEL32(00000000,00000000,00AA9B69,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00AA9D67
                                                  • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00AAB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00AA9D96
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$AttributesCopy
                                                  • String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
                                                  • API String ID: 1969131206-836986073
                                                  • Opcode ID: c91259d461b2eea8f281e55e6c52a2000bbbc240aca9989e9b82043ffec7fc78
                                                  • Instruction ID: 1d009f649089625b365c3f12750b88780b10e82b4a9c64b8ac4a9fa551279d92
                                                  • Opcode Fuzzy Hash: c91259d461b2eea8f281e55e6c52a2000bbbc240aca9989e9b82043ffec7fc78
                                                  • Instruction Fuzzy Hash: 7331E872A41525BBDB20AF96CD46EAB776CBF42B20B158119BD05EF281E721DD01C7E0
                                                  Function 00A98EBC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00A99007
                                                  Strings
                                                  • Failed to create ACL to secure cache path: %ls, xrefs: 00A98FBB
                                                  • cache.cpp, xrefs: 00A98FB0
                                                  • Failed to allocate access for Everyone group to path: %ls, xrefs: 00A98F51
                                                  • Failed to allocate access for Users group to path: %ls, xrefs: 00A98F72
                                                  • Failed to allocate access for Administrators group to path: %ls, xrefs: 00A98F0F
                                                  • Failed to secure cache path: %ls, xrefs: 00A98FEA
                                                  • Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00A98F30
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeLocal
                                                  • String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
                                                  • API String ID: 2826327444-4113288589
                                                  • Opcode ID: 1ca9940f86222fd4c9e3d42d5cdf8020189a688d0228335105316ee41e9a5dfb
                                                  • Instruction ID: 28746fd8a20659a14ad7c3ed382a5aa6dd42b19698aa48a47df0f98b5df73483
                                                  • Opcode Fuzzy Hash: 1ca9940f86222fd4c9e3d42d5cdf8020189a688d0228335105316ee41e9a5dfb
                                                  • Instruction Fuzzy Hash: 28410832B45325B7DF319658CD46FAE76A8EB42B10F1100A5FA05BB281EF799E4487A0
                                                  Function 00A9492F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ReadFile.KERNEL32(00000000,crypt32.dll,00000008,?,00000000,?,00000000,00000000,crypt32.dll,00000000,?,?,?,00000000,?,00000000), ref: 00A9495A
                                                  • GetLastError.KERNEL32 ref: 00A94967
                                                  • ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 00A94A12
                                                  • GetLastError.KERNEL32 ref: 00A94A1C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastRead
                                                  • String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$crypt32.dll$pipe.cpp
                                                  • API String ID: 1948546556-773887359
                                                  • Opcode ID: 29c30e86919f5b859e7a79894092a2eb7acee0f15933d68f5f8d35518d696b34
                                                  • Instruction ID: 7cba71c45457b158948f0a3e23b9df716d67308ac0c96dfddf4a808a76775810
                                                  • Opcode Fuzzy Hash: 29c30e86919f5b859e7a79894092a2eb7acee0f15933d68f5f8d35518d696b34
                                                  • Instruction Fuzzy Hash: AB31E736F40229BBDF209B95CD46FAFBBA8BB08B61F118125FD41A7280D7709D0187D4
                                                  Function 00AC6C29 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 114COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7622DFD0), ref: 00AC6C88
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00AC6CA5
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6CE3
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6D27
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$CompareFree
                                                  • String ID: `Dv$email$name$uri
                                                  • API String ID: 3589242889-3963012511
                                                  • Opcode ID: 0dd46b2520980a5af52849a150bf4442ea0d0fb6c76ed321f764bee6e51d6660
                                                  • Instruction ID: c564e9ed0cf18a07b18c3cbbacb34009c20368c72fbef73fbe16ecbbbfbb13f4
                                                  • Opcode Fuzzy Hash: 0dd46b2520980a5af52849a150bf4442ea0d0fb6c76ed321f764bee6e51d6660
                                                  • Instruction Fuzzy Hash: 28415E36A05219BBCF12DB94CD45FADB774EF44721F2242A8E921AB2E0C7719E01DB50
                                                  Function 00A9E2AF Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • LoadBitmapW.USER32(?,00000001), ref: 00A9E2E5
                                                  • GetLastError.KERNEL32 ref: 00A9E2F1
                                                  • GetObjectW.GDI32(00000000,00000018,?), ref: 00A9E338
                                                  • GetCursorPos.USER32(?), ref: 00A9E359
                                                  • MonitorFromPoint.USER32(?,?,00000002), ref: 00A9E36B
                                                  • GetMonitorInfoW.USER32(00000000,?), ref: 00A9E381
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
                                                  • String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
                                                  • API String ID: 2342928100-598475503
                                                  • Opcode ID: 4bbca55db19eff5d783b6d3c0c81f20dc809df15c77beb587760e9527a6b7958
                                                  • Instruction ID: b8bab4304ac2243ab76e52d7d1f0963d4bb1ada14d645f29b2b53b102996c216
                                                  • Opcode Fuzzy Hash: 4bbca55db19eff5d783b6d3c0c81f20dc809df15c77beb587760e9527a6b7958
                                                  • Instruction Fuzzy Hash: 2B315275A00219AFDB10DFA8D94AA9EBBF4FF08710F158515F905EF285DB71E901CBA0
                                                  Function 00A950CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcessId.KERNEL32(?,00000000,?,?,00ACB500), ref: 00A950D3
                                                  • GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00A95171
                                                  • CloseHandle.KERNEL32(00000000), ref: 00A9518A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Process$CloseCurrentHandle
                                                  • String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
                                                  • API String ID: 2815245435-1352204306
                                                  • Opcode ID: 688fc70fb011098b9f8ccfb46189211e799d6c802ed24f48b225ebbe77a466b9
                                                  • Instruction ID: c3be081b180cbefff9aedd6c4c50d3a4c8f150c2a4f19b91092393fc65b352b4
                                                  • Opcode Fuzzy Hash: 688fc70fb011098b9f8ccfb46189211e799d6c802ed24f48b225ebbe77a466b9
                                                  • Instruction Fuzzy Hash: 9A215175D0060DFF8F11AFA4DD42DAEBBB8FF08350B51416AF915A2211D7319E509B90
                                                  Function 00A86882 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 75libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00A868AC
                                                  • GetProcAddress.KERNEL32(00000000), ref: 00A868B3
                                                  • GetLastError.KERNEL32 ref: 00A868BD
                                                  Strings
                                                  • Failed to set variant value., xrefs: 00A86929
                                                  • variable.cpp, xrefs: 00A868E1
                                                  • Failed to find DllGetVersion entry point in msi.dll., xrefs: 00A868EB
                                                  • Failed to get msi.dll version info., xrefs: 00A86905
                                                  • DllGetVersion, xrefs: 00A8689E
                                                  • msi, xrefs: 00A868A3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorHandleLastModuleProc
                                                  • String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
                                                  • API String ID: 4275029093-842451892
                                                  • Opcode ID: e72a68415b7793ec04dd1c93d10896d557faa0edd7374f80e55a77e1aa7fe1e9
                                                  • Instruction ID: 9df6c9a8598fbe643fa13c028e05a8e7fd88fd8be84374ad5a3ee5572480011a
                                                  • Opcode Fuzzy Hash: e72a68415b7793ec04dd1c93d10896d557faa0edd7374f80e55a77e1aa7fe1e9
                                                  • Instruction Fuzzy Hash: 00118776E40635B6E720BBACDD46EAFBBA4AB04B50F020929FD05F7281D6759D0483E1
                                                  Function 00A8D6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00A847FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00A8548E,?), ref: 00A8D6DA
                                                  • GetLastError.KERNEL32(?,00A847FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00A8548E,?,?), ref: 00A8D6E7
                                                  • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00A8D71F
                                                  • GetLastError.KERNEL32(?,00A847FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00A8548E,?,?), ref: 00A8D72B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$AddressLibraryLoadProc
                                                  • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                  • API String ID: 1866314245-2276003667
                                                  • Opcode ID: 0de17e0d23e31a66da0e12fd6540d9feb3d9dd54acb3ba04a95aabc3c7ff16a3
                                                  • Instruction ID: 5415137e8de8ab86bcd1a8f8363c09c1b774231fb12157ece1e18ab8fc469274
                                                  • Opcode Fuzzy Hash: 0de17e0d23e31a66da0e12fd6540d9feb3d9dd54acb3ba04a95aabc3c7ff16a3
                                                  • Instruction Fuzzy Hash: 4D118637A80736ABDB2167959C05F5B6B94BB05B61F02492DBE54BB1C0E621DC0047E4
                                                  Function 00A81175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A81186
                                                  • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A81191
                                                  • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00A8119F
                                                  • GetLastError.KERNEL32(?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A811BA
                                                  • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00A811C2
                                                  • GetLastError.KERNEL32(?,?,?,?,?,00A8111A,cabinet.dll,00000009,?,?,00000000), ref: 00A811D7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorLastProc$HandleHeapInformationModule
                                                  • String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
                                                  • API String ID: 3104334766-1824683568
                                                  • Opcode ID: 3ed283e0e47ede9d99a8e3cd5d2ac552a15a78c405eb8c300db36864debe710b
                                                  • Instruction ID: 9bdfb786d70b7202eb5cf58384fb46f56a0b2469a250bce4abd7f661c634e850
                                                  • Opcode Fuzzy Hash: 3ed283e0e47ede9d99a8e3cd5d2ac552a15a78c405eb8c300db36864debe710b
                                                  • Instruction Fuzzy Hash: 0601B13121021ABBDB10BBA69C4AEAF7B5CFB40761F024119FA5592140EB72DA42CBF0
                                                  Function 00A9F639 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00A9F64E
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00A9F7C9
                                                  Strings
                                                  • Failed to set download password., xrefs: 00A9F777
                                                  • UX did not provide container or payload id., xrefs: 00A9F7B8
                                                  • UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00A9F6B9
                                                  • UX requested unknown payload with id: %ls, xrefs: 00A9F6A3
                                                  • UX requested unknown container with id: %ls, xrefs: 00A9F6F3
                                                  • Failed to set download user., xrefs: 00A9F751
                                                  • Failed to set download URL., xrefs: 00A9F728
                                                  • user is active, cannot change user state., xrefs: 00A9F668
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: user is active, cannot change user state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                  • API String ID: 3168844106-2615595102
                                                  • Opcode ID: 06f408fdbdd3370d1364859d45f176fa7ec7dfe240387189755051c76630b1c8
                                                  • Instruction ID: b18b60f118a6399a8db4fcb98aba7a26bca1d322c8b048b1bcbfb55a5e2d1047
                                                  • Opcode Fuzzy Hash: 06f408fdbdd3370d1364859d45f176fa7ec7dfe240387189755051c76630b1c8
                                                  • Instruction Fuzzy Hash: 7241A332B00611AFDF219BA8C845F6A73E8AF10710B154566F805EB250EB71ED50C7A1
                                                  Function 00AC5A5E Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196filememoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00AC5A9B
                                                  • GetLastError.KERNEL32 ref: 00AC5AA9
                                                  • VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00AC5AEA
                                                  • GetLastError.KERNEL32 ref: 00AC5AF7
                                                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AC5C6A
                                                  • CloseHandle.KERNEL32(?), ref: 00AC5C79
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
                                                  • String ID: GET$dlutil.cpp
                                                  • API String ID: 2028584396-3303425918
                                                  • Opcode ID: 82c74ea9c7bd825b929f94ae7262eee511bbd969246ee4ffe98b2af48299dc5b
                                                  • Instruction ID: 5dc378847dc8c7e1d8cd69afb4f34097b37f018960c485613f3f5a2dc6e84d67
                                                  • Opcode Fuzzy Hash: 82c74ea9c7bd825b929f94ae7262eee511bbd969246ee4ffe98b2af48299dc5b
                                                  • Instruction Fuzzy Hash: 38613A72E00619ABDB11CFA9CD85FEEBBB8AF48750F164119FD15A7240E770AD808B90
                                                  Function 00A90C50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A91020: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00A90C6F,?,00000000,?,00000000,00000000), ref: 00A9104F
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00A90DF3
                                                  • GetLastError.KERNEL32 ref: 00A90E00
                                                  Strings
                                                  • Failed to append package start action., xrefs: 00A90C95
                                                  • Failed to create syncpoint event., xrefs: 00A90E2E
                                                  • Failed to append cache action., xrefs: 00A90D4A
                                                  • Failed to append payload cache action., xrefs: 00A90DAA
                                                  • plan.cpp, xrefs: 00A90E24
                                                  • Failed to append rollback cache action., xrefs: 00A90CCF
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareCreateErrorEventLastString
                                                  • String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
                                                  • API String ID: 801187047-2489563283
                                                  • Opcode ID: 5d58fb7111f20ebff5a7f0e6b8b544bc63adbe60f4a90fdd471dc23c3ef935ee
                                                  • Instruction ID: ee5e935b550d344615c28e656bfae3d1f84009270d564eaadbcf85238fe4a9db
                                                  • Opcode Fuzzy Hash: 5d58fb7111f20ebff5a7f0e6b8b544bc63adbe60f4a90fdd471dc23c3ef935ee
                                                  • Instruction Fuzzy Hash: 71613B75600605EFCB05DF58C980EAABBF9FF88350F22845AE9199B311EB31EE41DB50
                                                  Function 00AC6EFF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,7622DFD0,000000FF,type,000000FF,?,7622DFD0,7622DFD0,7622DFD0), ref: 00AC6F55
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6FA0
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC701C
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7068
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Free$Compare
                                                  • String ID: `Dv$type$url
                                                  • API String ID: 1324494773-3411263640
                                                  • Opcode ID: 1c0190459b33f84ca16255f11cc5f37ecfabae0132d746da59c1d3fed9e3cd3c
                                                  • Instruction ID: e31cc529fd1131d1bb61f20facb428238d2db795a7f5f82391019f4073cf564b
                                                  • Opcode Fuzzy Hash: 1c0190459b33f84ca16255f11cc5f37ecfabae0132d746da59c1d3fed9e3cd3c
                                                  • Instruction Fuzzy Hash: 74512C36905219EFCF15DBA4C945FAEBBB8AF04711F26429DE511AB2A0D7319E00DB90
                                                  Function 00A905A2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 133registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00ACB500,00000000,?), ref: 00A906D3
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00ACB500,00000000,?), ref: 00A906E2
                                                    • Part of subcall function 00AC0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00A9061A,?,00000000,00020006), ref: 00AC0C0E
                                                  Strings
                                                  • %ls.RebootRequired, xrefs: 00A905F0
                                                  • crypt32.dll, xrefs: 00A905AC
                                                  • Failed to write volatile reboot required registry key., xrefs: 00A9061E
                                                  • Failed to open registration key., xrefs: 00A9071A
                                                  • Failed to update resume mode., xrefs: 00A906B7
                                                  • Failed to delete registration key: %ls, xrefs: 00A90681
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close$Create
                                                  • String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.$crypt32.dll
                                                  • API String ID: 359002179-3398658923
                                                  • Opcode ID: f444f17a3d9ebb5cf02408bbcd818702b6583669be9df5efd683ca29e0ed2542
                                                  • Instruction ID: 8007a399adf29d882211658919bbe17429f4751c67845cd782d445fe1bb778bf
                                                  • Opcode Fuzzy Hash: f444f17a3d9ebb5cf02408bbcd818702b6583669be9df5efd683ca29e0ed2542
                                                  • Instruction Fuzzy Hash: 3141A332A00718FFDF22AFA4CD06EAF7BFAAF80350F14441AF655A1161D7B19A60DB51
                                                  Function 00A8F451 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8F48A
                                                    • Part of subcall function 00A84115: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?), ref: 00A84123
                                                    • Part of subcall function 00A84115: GetLastError.KERNEL32(?,00A9A0E8,00000000,00000000,?,00000000,00A853BD,00000000,?,?,00A8D5B5,?,00000000,00000000), ref: 00A84131
                                                  • lstrlenA.KERNEL32(00ACB500,00000000,00000094,00000000,00000094,?,?,00A904BF,swidtag,00000094,?,00ACB518,00A904BF,00000000,?,00000000), ref: 00A8F4DD
                                                    • Part of subcall function 00AC4DB3: CreateFileW.KERNEL32(00ACB500,40000000,00000001,00000000,00000002,00000080,00000000,00A904BF,00000000,?,00A8F4F4,?,00000080,00ACB500,00000000), ref: 00AC4DCB
                                                    • Part of subcall function 00AC4DB3: GetLastError.KERNEL32(?,00A8F4F4,?,00000080,00ACB500,00000000,?,00A904BF,?,00000094,?,?,?,?,?,00000000), ref: 00AC4DD8
                                                  Strings
                                                  • swidtag, xrefs: 00A8F49D
                                                  • Failed to allocate regid folder path., xrefs: 00A8F53C
                                                  • Failed to write tag xml to file: %ls, xrefs: 00A8F51B
                                                  • Failed to format tag folder path., xrefs: 00A8F543
                                                  • Failed to allocate regid file path., xrefs: 00A8F535
                                                  • Failed to create regid folder: %ls, xrefs: 00A8F525
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
                                                  • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
                                                  • API String ID: 904508749-1201533908
                                                  • Opcode ID: c028db1f5ac1dc5e769a9233496eaeeef9b10e53e4466cc3fa1e075d5f0afaeb
                                                  • Instruction ID: ab2daf0ca73ef2166e8aeea0c72e95ad3b92a99740820597f68f0079ce4e30a4
                                                  • Opcode Fuzzy Hash: c028db1f5ac1dc5e769a9233496eaeeef9b10e53e4466cc3fa1e075d5f0afaeb
                                                  • Instruction Fuzzy Hash: 88315A31D4021AFFCB25AFA8DD41BADBBB5BF08710F108166F911AA251D7719E509B90
                                                  Function 00A953E2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00A8548E,00000000,00000000,?,00000000), ref: 00A9548B
                                                  • GetLastError.KERNEL32(?,?,?,00A84C61,?,?,00000000,?,?,?,?,?,?,00ACB4A0,?,?), ref: 00A95496
                                                  Strings
                                                  • Failed to wait for child process exit., xrefs: 00A954C4
                                                  • Failed to post terminate message to child process cache thread., xrefs: 00A9545A
                                                  • Failed to write exit code to message buffer., xrefs: 00A95406
                                                  • Failed to post terminate message to child process., xrefs: 00A95476
                                                  • Failed to write restart to message buffer., xrefs: 00A9542E
                                                  • pipe.cpp, xrefs: 00A954BA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastObjectSingleWait
                                                  • String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
                                                  • API String ID: 1211598281-2161881128
                                                  • Opcode ID: 524d905c7d1c24b644028abcf4a64603aa2f0664874a7a9a0d12bb290f917781
                                                  • Instruction ID: 4baadde946b65d9532b63149f2b7b7e67d6fecc771f4c894077ac8919fc94219
                                                  • Opcode Fuzzy Hash: 524d905c7d1c24b644028abcf4a64603aa2f0664874a7a9a0d12bb290f917781
                                                  • Instruction Fuzzy Hash: 1621D533E40A25BBCF135BA4DD07E9E77EAAF44721F114212F900B6290D730AE9097E0
                                                  Function 00A99098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00A99F04,00000003,000007D0,00000003,?,000007D0), ref: 00A990B2
                                                  • GetLastError.KERNEL32(?,00A99F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 00A990BF
                                                  • CloseHandle.KERNEL32(00000000,?,00A99F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 00A99187
                                                  Strings
                                                  • Failed to verify catalog signature of payload: %ls, xrefs: 00A9914E
                                                  • cache.cpp, xrefs: 00A990F6
                                                  • Failed to verify hash of payload: %ls, xrefs: 00A99172
                                                  • Failed to verify signature of payload: %ls, xrefs: 00A9912F
                                                  • Failed to open payload at path: %ls, xrefs: 00A99103
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLast
                                                  • String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
                                                  • API String ID: 2528220319-2757871984
                                                  • Opcode ID: fa70defaa814b7cab34de5749b17c4d1bfa71ca5636416737aae721718449913
                                                  • Instruction ID: 6424bc74e8094d74db66bab26daa2bbbf68ffdaeade45a2ceddf1262a7bc59ec
                                                  • Opcode Fuzzy Hash: fa70defaa814b7cab34de5749b17c4d1bfa71ca5636416737aae721718449913
                                                  • Instruction Fuzzy Hash: 0D21B436740626B7CF721A5D8C4AF9BBA98BF04760F21431AFD156A2A093319C51DAD1
                                                  Function 00A86B1E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00A86B69
                                                  • GetLastError.KERNEL32 ref: 00A86B73
                                                  • GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00A86BB7
                                                  • GetLastError.KERNEL32 ref: 00A86BC1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$DirectoryNamePathVolumeWindows
                                                  • String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 124030351-4026719079
                                                  • Opcode ID: 7c0a5038aa8c41c62e8855d69db0b43ced76f9dae6f2ef36aaa0f1820375c259
                                                  • Instruction ID: 74a4ace532465715b2160cb40a1180fc87a6cd04e0f927daf7e9aa28c5caf20d
                                                  • Opcode Fuzzy Hash: 7c0a5038aa8c41c62e8855d69db0b43ced76f9dae6f2ef36aaa0f1820375c259
                                                  • Instruction Fuzzy Hash: 9A21F773E4123967E720E7948D0AF9B77ACAB00B20F024565BD04FB181EB34EE4087E5
                                                  Function 00A89C6D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89C88
                                                  • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,000002C0,?,00A8A895,00000100,000002C0,000002C0,?,000002C0), ref: 00A89CA0
                                                  • GetLastError.KERNEL32(?,00A8A895,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00A89CAB
                                                  Strings
                                                  • search.cpp, xrefs: 00A89CDB
                                                  • Failed get to file attributes. '%ls', xrefs: 00A89CE8
                                                  • File search: %ls, did not find path: %ls, xrefs: 00A89CFD
                                                  • Failed to format variable string., xrefs: 00A89C93
                                                  • Failed to set variable., xrefs: 00A89D2B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileLastOpen@16
                                                  • String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
                                                  • API String ID: 1811509786-2053429945
                                                  • Opcode ID: e5a8b4e9130b763dc5eebb3802f3d76bef6b3cb294c4af0ba623c7aab76b8caf
                                                  • Instruction ID: 7c0467017f8e9d934dec3526fbf309632681d26580796ea077fa29daaab4734d
                                                  • Opcode Fuzzy Hash: e5a8b4e9130b763dc5eebb3802f3d76bef6b3cb294c4af0ba623c7aab76b8caf
                                                  • Instruction Fuzzy Hash: 41216573940124FEEB217B988D42FBFBA68EF10761F2A0225FD0476090E7225D10A7E4
                                                  Function 00A9AD40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • TlsSetValue.KERNEL32(?,?), ref: 00A9AD57
                                                  • GetLastError.KERNEL32 ref: 00A9AD61
                                                  • CoInitializeEx.OLE32(00000000,00000000), ref: 00A9ADA0
                                                  • CoUninitialize.OLE32(?,00A9C721,?,?), ref: 00A9ADDD
                                                  Strings
                                                  • Failed to initialize COM., xrefs: 00A9ADAC
                                                  • elevation.cpp, xrefs: 00A9AD85
                                                  • Failed to pump messages in child process., xrefs: 00A9ADCB
                                                  • Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00A9AD8F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorInitializeLastUninitializeValue
                                                  • String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
                                                  • API String ID: 876858697-113251691
                                                  • Opcode ID: afde15cae2a4fa60034a02b10376366f37d50c8942168cd943789b0e57b9a862
                                                  • Instruction ID: 4587dfccf91d3993fdcab46c603ad22cfc5af38a6112869975dccbe4a55de8f5
                                                  • Opcode Fuzzy Hash: afde15cae2a4fa60034a02b10376366f37d50c8942168cd943789b0e57b9a862
                                                  • Instruction Fuzzy Hash: 23113A73A11531B78F215794CC06E9EBAE8EF14B62B120217FD01B7610EB319D0086E1
                                                  Function 00A85CE2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00A85D68
                                                    • Part of subcall function 00AC10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00AC112B
                                                    • Part of subcall function 00AC10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00AC1163
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue$Close
                                                  • String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
                                                  • API String ID: 1979452859-3209209246
                                                  • Opcode ID: ba6c5ed885a28d2eb760407e6bdc5600b7136aafad6950ca32525abcfbdb36d5
                                                  • Instruction ID: f32d8abb16114853332af41696b1941fbaefc08374e1fb99fe6661301b46cf92
                                                  • Opcode Fuzzy Hash: ba6c5ed885a28d2eb760407e6bdc5600b7136aafad6950ca32525abcfbdb36d5
                                                  • Instruction Fuzzy Hash: CD01B532E44528F7CF22A6A8DD0AFAEB768DF00760F16426DFD047A221D7718E0097D0
                                                  Function 00AAA271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00AAA33E
                                                  • GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 00AAA348
                                                  Strings
                                                  • Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00AAA425
                                                  • :, xrefs: 00AAA3C1
                                                  • apply.cpp, xrefs: 00AAA36C
                                                  • download, xrefs: 00AAA308
                                                  • Failed to clear readonly bit on payload destination path: %ls, xrefs: 00AAA377
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileLast
                                                  • String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
                                                  • API String ID: 1799206407-1905830404
                                                  • Opcode ID: 8b71a0c0d51dc9a6a9618aa4b9ab6d58d771526df97f17be7d24ccd04c36cffe
                                                  • Instruction ID: 9457da24dff525cb9ce851ec3bd890a3e253c0afac3e582a6f0baffde97af9a5
                                                  • Opcode Fuzzy Hash: 8b71a0c0d51dc9a6a9618aa4b9ab6d58d771526df97f17be7d24ccd04c36cffe
                                                  • Instruction Fuzzy Hash: 26517F75A00619AFDF11DFA9C841EEEB7F8BF25710F10855AE905EB290E371DA40CBA1
                                                  Function 00AC84C7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00AA9063,000002C0,00000100), ref: 00AC84F5
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00AA9063,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00AC8510
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareHeapString$AllocateProcess
                                                  • String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
                                                  • API String ID: 2664528157-4206478990
                                                  • Opcode ID: 7625e473b03543c53ad44c2d99a920799a8812fd7caedfacf2b530f392b3acbd
                                                  • Instruction ID: d642927bb1d0d18e9550ac702d46268ab0abbe1c111a121ed5834cd81bdaed3c
                                                  • Opcode Fuzzy Hash: 7625e473b03543c53ad44c2d99a920799a8812fd7caedfacf2b530f392b3acbd
                                                  • Instruction Fuzzy Hash: 1B51A331644705BFDB209F59CD82F1A7BA5BF00760F22861CF965AB2D1DBB9ED408B50
                                                  Function 00AC64B7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32 ref: 00AC6513
                                                  • DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00AC660A
                                                  • CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00AC6619
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseDeleteErrorFileHandleLast
                                                  • String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
                                                  • API String ID: 3522763407-1704223933
                                                  • Opcode ID: e53aa078e01b89c680ede86883b110cc2a8a3a87b4b3c180abb6106e28d6c9fc
                                                  • Instruction ID: 3afd5e245bd3dc0b02982aea53c18c28dcd80bc1cbdc013458d7441b0ccb0297
                                                  • Opcode Fuzzy Hash: e53aa078e01b89c680ede86883b110cc2a8a3a87b4b3c180abb6106e28d6c9fc
                                                  • Instruction Fuzzy Hash: B6513872D00219BFDF12DFE4CD45EAEBBB9EB08750F124169FA14E6150E7319A119BA0
                                                  Function 00A89EC7 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89EED
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89F12
                                                  Strings
                                                  • Failed to format product code string., xrefs: 00A89F1D
                                                  • Failed to format component id string., xrefs: 00A89EF8
                                                  • MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00A8A006
                                                  • Failed to get component path: %d, xrefs: 00A89F76
                                                  • Failed to set variable., xrefs: 00A89FF6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16
                                                  • String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
                                                  • API String ID: 3613110473-1671347822
                                                  • Opcode ID: 4ae15097e94be70ac09aa363e8b80d86eb9ac2cd0cd5e2b1f81fe214c9e7b3ba
                                                  • Instruction ID: 667b3c98862eaec113fb79ef1aeff1b76e675af48f3b2dc6ec7677b1cb513fc7
                                                  • Opcode Fuzzy Hash: 4ae15097e94be70ac09aa363e8b80d86eb9ac2cd0cd5e2b1f81fe214c9e7b3ba
                                                  • Instruction Fuzzy Hash: DB41D132900115BACF29BBA88D46FBFB778EF04310F2C4616F615E6191EB309E50D792
                                                  Function 00A8F812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00A8F942
                                                  • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00A8F94F
                                                  Strings
                                                  • %ls.RebootRequired, xrefs: 00A8F82F
                                                  • Failed to open registration key., xrefs: 00A8F8AB
                                                  • Failed to format pending restart registry key to read., xrefs: 00A8F846
                                                  • Failed to read Resume value., xrefs: 00A8F8D8
                                                  • Resume, xrefs: 00A8F8B6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close
                                                  • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                  • API String ID: 3535843008-3890505273
                                                  • Opcode ID: 517acc72f86b8731bbee8ba61222200f4adc8f27c733d4e633f964800067ac70
                                                  • Instruction ID: 7da921b6bf91641d0c32f8f17e9bf50a29e658bf3b1a3405b81cb4d0ea55a6de
                                                  • Opcode Fuzzy Hash: 517acc72f86b8731bbee8ba61222200f4adc8f27c733d4e633f964800067ac70
                                                  • Instruction Fuzzy Hash: 37414C7190015AFFCB12AFA8C981BADBBB4FB04310F56817AE911AB310C371AE51DB90
                                                  Function 00A9AA00 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
                                                  • API String ID: 0-660234312
                                                  • Opcode ID: 5887b97b0998456a4ea4ca384650926ae5d7e4c083472b4194ea8fec03513ef1
                                                  • Instruction ID: 01526c70c0b9028b8f69451abdcc1cd31c3fde6d6c21ae93dd0e6a506ccf53b5
                                                  • Opcode Fuzzy Hash: 5887b97b0998456a4ea4ca384650926ae5d7e4c083472b4194ea8fec03513ef1
                                                  • Instruction Fuzzy Hash: B831A332A00129BBCF229B98CD45EAEBBB9EB10760F214256F911B62D0DB719E41C7D1
                                                  Function 00AAD8B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CoCreateInstance.OLE32(00AE0C4C,00000000,00000017,00AE0C5C,?,?,00000000,00000000,?,?,?,?,?,00AADEE7,00000000,00000000), ref: 00AAD8E8
                                                  Strings
                                                  • WixBurn, xrefs: 00AAD913
                                                  • Failed to set progress timeout., xrefs: 00AAD952
                                                  • Failed to set notification flags for BITS job., xrefs: 00AAD93A
                                                  • Failed to set BITS job to foreground., xrefs: 00AAD969
                                                  • Failed to create IBackgroundCopyManager., xrefs: 00AAD8F4
                                                  • Failed to create BITS job., xrefs: 00AAD922
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateInstance
                                                  • String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
                                                  • API String ID: 542301482-468763447
                                                  • Opcode ID: e15861b575e93d5530fca034954733fe0d96f958b085269ee421047c2a089e60
                                                  • Instruction ID: ed5d7c73b814230dc0eb89309b0956418b5837a5b8cd90edc3354d7d7bf5e7e1
                                                  • Opcode Fuzzy Hash: e15861b575e93d5530fca034954733fe0d96f958b085269ee421047c2a089e60
                                                  • Instruction Fuzzy Hash: 6331A531F40355AF9714DFA9C845D7FBBB4AF89710B100559E942EB790CB70DC458791
                                                  Function 00AC5DAE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00AC5DF8
                                                  • GetLastError.KERNEL32 ref: 00AC5E05
                                                  • ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00AC5E4C
                                                  • GetLastError.KERNEL32 ref: 00AC5E80
                                                  • CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 00AC5EB4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$CloseCreateHandleRead
                                                  • String ID: %ls.R$dlutil.cpp
                                                  • API String ID: 3160720760-657863730
                                                  • Opcode ID: 863da3bfa6ebb2b3a21dda2be3c579bf60ed1128ecc4146703d96a13a8bd10e3
                                                  • Instruction ID: 36110e3334d181c42ed334e115f6cc8794388ae5fe2e385c66ea5718116b9257
                                                  • Opcode Fuzzy Hash: 863da3bfa6ebb2b3a21dda2be3c579bf60ed1128ecc4146703d96a13a8bd10e3
                                                  • Instruction Fuzzy Hash: F631E972D41624BBD7208BA8CC45F6E7BA4EF00761F124219FE11AB2C0D770AE4087A4
                                                  Function 00A8C8E6 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8CD5E: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,00A8E444,000000FF,00000000,00000000,00A8E444,?,?,00A8DBEB,?,?,?,?), ref: 00A8CD89
                                                  • CreateFileW.KERNEL32(E900ACBA,80000000,00000005,00000000,00000003,08000000,00000000,00A853C5,?,00000000,840F01E8,14680A79,00000001,00A853BD,00000000,00A85489), ref: 00A8C956
                                                  • GetLastError.KERNEL32(?,?,?,00A97809,00A8566D,00A85479,00A85479,00000000,?,00A85489,FFF9E89D,00A85489,00A854BD,00A85445,?,00A85445), ref: 00A8C99B
                                                  Strings
                                                  • Failed to verify catalog signature: %ls, xrefs: 00A8C994
                                                  • Failed to find payload for catalog file., xrefs: 00A8C9E0
                                                  • Failed to get catalog local file path, xrefs: 00A8C9D9
                                                  • catalog.cpp, xrefs: 00A8C9BC
                                                  • Failed to open catalog in working path: %ls, xrefs: 00A8C9C9
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareCreateErrorFileLastString
                                                  • String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
                                                  • API String ID: 1774366664-48089280
                                                  • Opcode ID: 4fdb201937565de6c6060afdb0003e16e23b093cb9c2ff0a5a62254bdcbcb04a
                                                  • Instruction ID: fbb35d06d305d42f8994058ca3aaa0f25878a09094e5dd085c5dcefd20795c83
                                                  • Opcode Fuzzy Hash: 4fdb201937565de6c6060afdb0003e16e23b093cb9c2ff0a5a62254bdcbcb04a
                                                  • Instruction Fuzzy Hash: 2231C932940625BFCB21BB58CD46F59BBA5FF04730F2145AAF904EB240E771AD109BE0
                                                  Function 00AAD33E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,?,00AAD642,?), ref: 00AAD357
                                                  • ReleaseMutex.KERNEL32(?,?,?,?,00AAD642,?), ref: 00AAD375
                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AAD3B6
                                                  • ReleaseMutex.KERNEL32(?), ref: 00AAD3CD
                                                  • SetEvent.KERNEL32(?), ref: 00AAD3D6
                                                  Strings
                                                  • Failed to send files in use message from netfx chainer., xrefs: 00AAD41C
                                                  • Failed to get message from netfx chainer., xrefs: 00AAD3F7
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: MutexObjectReleaseSingleWait$Event
                                                  • String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
                                                  • API String ID: 2608678126-3424578679
                                                  • Opcode ID: f0b4723c353ab63d307077c33b4a6efe9fa38d64d17477f256b5dd78b4af32c6
                                                  • Instruction ID: b578b7ca9c28ef46e9d23a364d75ea446688356011bfc404ab8b7cafc49f3138
                                                  • Opcode Fuzzy Hash: f0b4723c353ab63d307077c33b4a6efe9fa38d64d17477f256b5dd78b4af32c6
                                                  • Instruction Fuzzy Hash: 4F310931900605BFCB119F98DC09EEEBBF8EF49320F108655F555A72A0C7719941CB90
                                                  Function 00AC093B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00AC09AB
                                                  • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00AC09B5
                                                  • CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 00AC09FE
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00AC0A0B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$CreateErrorLastProcess
                                                  • String ID: "%ls" %ls$D$procutil.cpp
                                                  • API String ID: 161867955-2732225242
                                                  • Opcode ID: 11f1912b537b15fdb6098e70d7456d14653377bdb37a99ed537d98089fe8a141
                                                  • Instruction ID: 05dcc7a93a4f4c529a1cb390205d9c6e299bd8543fc5dfb6f03fe25108a0fa96
                                                  • Opcode Fuzzy Hash: 11f1912b537b15fdb6098e70d7456d14653377bdb37a99ed537d98089fe8a141
                                                  • Instruction Fuzzy Hash: 9B215C72D0025EEBDB11DFE9CD41FAEBBB8AF04750F12042AEA00B7251D3719E008AA1
                                                  Function 00A89B9A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89BB3
                                                  • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00A8A8AB,00000100,000002C0,000002C0,00000100), ref: 00A89BD3
                                                  • GetLastError.KERNEL32(?,00A8A8AB,00000100,000002C0,000002C0,00000100), ref: 00A89BDE
                                                  Strings
                                                  • Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00A89C4A
                                                  • Failed while searching directory search: %ls, for path: %ls, xrefs: 00A89C34
                                                  • Failed to format variable string., xrefs: 00A89BBE
                                                  • Failed to set directory search path variable., xrefs: 00A89C0F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileLastOpen@16
                                                  • String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
                                                  • API String ID: 1811509786-2966038646
                                                  • Opcode ID: 2552d0c8df713cc881dd70a857243e50fd20fc948080ef8e0c523c6eb7e6fc00
                                                  • Instruction ID: 09f58f9eba06aeb344330e33a9718eba99ef798a0036f8a0f5dd695aeab29a5f
                                                  • Opcode Fuzzy Hash: 2552d0c8df713cc881dd70a857243e50fd20fc948080ef8e0c523c6eb7e6fc00
                                                  • Instruction Fuzzy Hash: D821F673940025FBCB227B988E06FAFBF68AF00320F250215FD1076151D7325E50ABD9
                                                  Function 00A89D4B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89D64
                                                  • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00A8A883,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00A89D84
                                                  • GetLastError.KERNEL32(?,00A8A883,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00A89D8F
                                                  Strings
                                                  • Failed while searching file search: %ls, for path: %ls, xrefs: 00A89DBD
                                                  • Failed to set variable to file search path., xrefs: 00A89DE7
                                                  • File search: %ls, did not find path: %ls, xrefs: 00A89DF3
                                                  • Failed to format variable string., xrefs: 00A89D6F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileLastOpen@16
                                                  • String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
                                                  • API String ID: 1811509786-3425311760
                                                  • Opcode ID: f3c3908fffac3f617898a69b8527a47285d8afc5a59ae30dc704c65d9033a310
                                                  • Instruction ID: c0559dd187d9833d4ef1452cfb3459bfe06fe7a18966bd14beb252c27f5672ac
                                                  • Opcode Fuzzy Hash: f3c3908fffac3f617898a69b8527a47285d8afc5a59ae30dc704c65d9033a310
                                                  • Instruction Fuzzy Hash: 9B11A233D40525FBDF22BB98CE02FAEBA65AF10720F250215F910B61A1E7325E20A7D5
                                                  Function 00A9CF25 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationthreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?), ref: 00A9CF37
                                                  • GetLastError.KERNEL32(?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00A9CF41
                                                  • GetExitCodeThread.KERNEL32(00000001,?,?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?,00000000), ref: 00A9CF7D
                                                  • GetLastError.KERNEL32(?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00A9CF87
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                  • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
                                                  • API String ID: 3686190907-1954264426
                                                  • Opcode ID: 1735e562da2d0c1d3689cfcc7b7570bae1380e481723dc638faa81b5824f6db7
                                                  • Instruction ID: 910d7705a32936fba256fbbb0c28338650aa7c0a6041b77311fafb7499f095d6
                                                  • Opcode Fuzzy Hash: 1735e562da2d0c1d3689cfcc7b7570bae1380e481723dc638faa81b5824f6db7
                                                  • Instruction Fuzzy Hash: 97012673B81B3573CF2097C98D0AE9E7A98AF00B71F024156BE05BB280E7618D0082E4
                                                  Function 00A969AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00A96EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00A969BB
                                                  • GetLastError.KERNEL32(?,00A96EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00A969C5
                                                  • GetExitCodeThread.KERNEL32(00000001,00000000,?,00A96EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00A96A04
                                                  • GetLastError.KERNEL32(?,00A96EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00A96A0E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                  • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
                                                  • API String ID: 3686190907-2546940223
                                                  • Opcode ID: 95557995a2572db5683b15a7c452bc6e5a9cb19c1e22e901f88d120eac76d9e4
                                                  • Instruction ID: 00695e52987cf7854f6a11e0655ed69ad28cf3004869b71e9c09b165308ffce0
                                                  • Opcode Fuzzy Hash: 95557995a2572db5683b15a7c452bc6e5a9cb19c1e22e901f88d120eac76d9e4
                                                  • Instruction Fuzzy Hash: AE115270740206BBDF10DFA5DE02B6E7AE8EF04751F104165B905EA1A0EB36CE009764
                                                  Function 00A9F7D9 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00A9F7EE
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00A9F8FB
                                                  Strings
                                                  • Failed to set source path for payload., xrefs: 00A9F88A
                                                  • UX requested unknown payload with id: %ls, xrefs: 00A9F85A
                                                  • UX requested unknown container with id: %ls, xrefs: 00A9F8BA
                                                  • Failed to set source path for container., xrefs: 00A9F8E0
                                                  • user is active, cannot change user state., xrefs: 00A9F808
                                                  • UX denied while trying to set source on embedded payload: %ls, xrefs: 00A9F870
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: user is active, cannot change user state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                  • API String ID: 3168844106-4121889706
                                                  • Opcode ID: 14f544e5ce24ff106ebdb9b743abfb6f6e88c180d728dd377bbbb24fffcc99b6
                                                  • Instruction ID: 0c7a0a8d2692e97ceee05346f4cf418cd1807bf8c5412d8556236e6ac0ab8f4d
                                                  • Opcode Fuzzy Hash: 14f544e5ce24ff106ebdb9b743abfb6f6e88c180d728dd377bbbb24fffcc99b6
                                                  • Instruction Fuzzy Hash: 5031E432B40621BF8F61AB59CC46EAA77ECAF14720B25C166F805EB340DB75ED4087A1
                                                  Function 00A871FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(00000000), ref: 00A87210
                                                  Strings
                                                  • Failed to format escape sequence., xrefs: 00A872AA
                                                  • Failed to copy string., xrefs: 00A872C4
                                                  • Failed to allocate buffer for escaped string., xrefs: 00A87227
                                                  • []{}, xrefs: 00A8723A
                                                  • Failed to append escape sequence., xrefs: 00A872A3
                                                  • [\%c], xrefs: 00A8726F
                                                  • Failed to append characters., xrefs: 00A8729C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen
                                                  • String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
                                                  • API String ID: 1659193697-3250950999
                                                  • Opcode ID: e66c3cdcc9e9b2fd490a9190d32f88a5c8cd175fec5097f2362ce881300385e9
                                                  • Instruction ID: ca8806a004f7216a50e15843798adbd1434eda3bff27312e42a69f16eb8046fa
                                                  • Opcode Fuzzy Hash: e66c3cdcc9e9b2fd490a9190d32f88a5c8cd175fec5097f2362ce881300385e9
                                                  • Instruction Fuzzy Hash: 8B219132949619BADB21B798CD42FEE7BADAB10730F31015AF900B6151EA75DE4193D0
                                                  Function 00AA5BDC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(00000000,00000000,00ACB500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,00AA67DE,?,00000001,?,00ACB4A0), ref: 00AA5C45
                                                  Strings
                                                  • Failed to plan action for target product., xrefs: 00AA5CF0
                                                  • feclient.dll, xrefs: 00AA5C3B, 00AA5D65
                                                  • Failed grow array of ordered patches., xrefs: 00AA5CDE
                                                  • Failed to insert execute action., xrefs: 00AA5C9A
                                                  • Failed to copy target product code., xrefs: 00AA5D78
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
                                                  • API String ID: 1825529933-3477540455
                                                  • Opcode ID: cb3b43bd3468567f7306d9551a03a4aa4855494b9fc320f96adbddf0b9e84760
                                                  • Instruction ID: 742c802df68d327a375cc920583cfd9b692575cda1f2f8ee76fd6faf9470cafa
                                                  • Opcode Fuzzy Hash: cb3b43bd3468567f7306d9551a03a4aa4855494b9fc320f96adbddf0b9e84760
                                                  • Instruction Fuzzy Hash: 818124B5A0074AEFCB14CF68C980AAA77A5BF09324B118669FD159B392D730ED11CF94
                                                  Function 00ABCAED Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00ABD262,00000000,00000000,00000000,00000000,00000000,00AB2F1D), ref: 00ABCB2F
                                                  • __fassign.LIBCMT ref: 00ABCBAA
                                                  • __fassign.LIBCMT ref: 00ABCBC5
                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00ABCBEB
                                                  • WriteFile.KERNEL32(?,00000000,00000000,00ABD262,00000000,?,?,?,?,?,?,?,?,?,00ABD262,00000000), ref: 00ABCC0A
                                                  • WriteFile.KERNEL32(?,00000000,00000001,00ABD262,00000000,?,?,?,?,?,?,?,?,?,00ABD262,00000000), ref: 00ABCC43
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                  • String ID:
                                                  • API String ID: 1324828854-0
                                                  • Opcode ID: 156d4c8596b1d93080e4a2bb42b9410f8a03638603c35225a65da86ba1fc8785
                                                  • Instruction ID: ecbbe30de968b3bfeb2897c63b03b25159acb0831a6ab0d6835ad6ccebda6591
                                                  • Opcode Fuzzy Hash: 156d4c8596b1d93080e4a2bb42b9410f8a03638603c35225a65da86ba1fc8785
                                                  • Instruction Fuzzy Hash: 6651A271A002499FDB10CFA8DC95EEEBFF8EF19310F14415AE955E7292E7309A41CB60
                                                  Function 00AA9279 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00A97113,000000B8,0000001C,00000100), ref: 00AA92A4
                                                  • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00ACB4B8,000000FF,?,?,?,00A97113,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00AA932E
                                                  Strings
                                                  • Failed to initialize update bundle., xrefs: 00AA93D1
                                                  • BA aborted detect forward compatible bundle., xrefs: 00AA9398
                                                  • detect.cpp, xrefs: 00AA938E
                                                  • comres.dll, xrefs: 00AA93B0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
                                                  • API String ID: 1825529933-439563586
                                                  • Opcode ID: 490b7b9246d9d7cc16557333c0b7d60704baaa2e1f291d5756983c6c8e35d843
                                                  • Instruction ID: 0a53820cffb84a0746e14647e8bac10f0c08459eac177ed8d97b9a4b8d30467d
                                                  • Opcode Fuzzy Hash: 490b7b9246d9d7cc16557333c0b7d60704baaa2e1f291d5756983c6c8e35d843
                                                  • Instruction Fuzzy Hash: 58519E71600611BBDF159F64CC81FAABBBAFF06310F144269F9249B2E1C771E861DBA0
                                                  Function 00A9AB9E Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 140COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(00A85479,000000FF,00AAC56B,E900ACBA,00A853BD,00000000,?,E900ACBA,00000000), ref: 00A9AC94
                                                  • GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00A85479,000000FF,00AAC56B,E900ACBA,00A853BD,00000000,?,E900ACBA,00000000), ref: 00A9ACD8
                                                  Strings
                                                  • Failed to get provider state from authenticode certificate., xrefs: 00A9ACC2
                                                  • cache.cpp, xrefs: 00A9AC6A, 00A9ACB8, 00A9ACFC
                                                  • Failed authenticode verification of payload: %ls, xrefs: 00A9AC75
                                                  • Failed to get signer chain from authenticode certificate., xrefs: 00A9AD06
                                                  • Failed to verify expected payload against actual certificate chain., xrefs: 00A9AD1E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast
                                                  • String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp
                                                  • API String ID: 1452528299-2590768268
                                                  • Opcode ID: af6804189d11368f201d1b0622e8acb1a81c3c5c0a6cac3920f8cecb229c01fa
                                                  • Instruction ID: ef14de9ab6581f6ee43ae74eaa830c5117506edf8e4fd388578ebdd8a8f2d9a2
                                                  • Opcode Fuzzy Hash: af6804189d11368f201d1b0622e8acb1a81c3c5c0a6cac3920f8cecb229c01fa
                                                  • Instruction Fuzzy Hash: C2416472E41629ABDB11DBD8CD45ADEBBB8EF14720F11062AFD01BB281D7709D048AE1
                                                  Function 00AC02F8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00AC033C
                                                  • GetComputerNameW.KERNEL32(?,?), ref: 00AC0394
                                                  Strings
                                                  • === Logging started: %ls ===, xrefs: 00AC03BF
                                                  • --- logging level: %hs ---, xrefs: 00AC0454
                                                  • Executable: %ls v%d.%d.%d.%d, xrefs: 00AC03F0
                                                  • Computer : %ls, xrefs: 00AC0402
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Name$ComputerFileModule
                                                  • String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
                                                  • API String ID: 2577110986-3153207428
                                                  • Opcode ID: 88df5d370dceebfad63db30b91faaa620cdfa308165237bedb13b82d4f44a422
                                                  • Instruction ID: 9f89ae2aeb5b20de4c7d1b6229b4e54862610a687ec59cd55abf0da2b9c7611c
                                                  • Opcode Fuzzy Hash: 88df5d370dceebfad63db30b91faaa620cdfa308165237bedb13b82d4f44a422
                                                  • Instruction Fuzzy Hash: A84142B290015CEBCB24DBA4DE85FEA77BCEB54300F4145AAF609E7142D630AE858F65
                                                  Function 00A9D437 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CloseHandle.KERNEL32(00000000,?,?,00000001,00ACB500,?,00000001,000000FF,?,?,7694B390,00000000,00000001,00000000,?,00A974E6), ref: 00A9D560
                                                  Strings
                                                  • Failed to connect to elevated child process., xrefs: 00A9D549
                                                  • Failed to create pipe name and client token., xrefs: 00A9D4A1
                                                  • Failed to elevate., xrefs: 00A9D542
                                                  • elevation.cpp, xrefs: 00A9D46B
                                                  • UX aborted elevation requirement., xrefs: 00A9D475
                                                  • Failed to create pipe and cache pipe., xrefs: 00A9D4BD
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle
                                                  • String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
                                                  • API String ID: 2962429428-3003415917
                                                  • Opcode ID: a41fa5c52d155f29b7da6d517d0ab44cb765fb08ad9956d10600dcac3018e413
                                                  • Instruction ID: f12a432a4ff2cd3f1db6c3f2bca93e1704b17baea961d40fdc5717b2b6a57877
                                                  • Opcode Fuzzy Hash: a41fa5c52d155f29b7da6d517d0ab44cb765fb08ad9956d10600dcac3018e413
                                                  • Instruction Fuzzy Hash: 95317C72B44625BBEF15A678CC43FBEB7DCAF00724F114616F905BA281EA61AD8083D1
                                                  Function 00A9D24B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateThread.KERNEL32(00000000,00000000,00A9AD40,?,00000000,00000000), ref: 00A9D2E9
                                                  • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A9D2F5
                                                    • Part of subcall function 00A9CF25: WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?), ref: 00A9CF37
                                                    • Part of subcall function 00A9CF25: GetLastError.KERNEL32(?,?,00A9D365,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00A9CF41
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,?,00A9C7C9,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00A9D376
                                                  Strings
                                                  • elevation.cpp, xrefs: 00A9D319
                                                  • Failed to create elevated cache thread., xrefs: 00A9D323
                                                  • Failed to pump messages in child process., xrefs: 00A9D34D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
                                                  • String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
                                                  • API String ID: 3606931770-4134175193
                                                  • Opcode ID: 0e17fe5f4cea8daf7568389822acc92f6502776036f37c0c25bdbbb31a48c6bf
                                                  • Instruction ID: f442eb3213dbdc21990ee0482cf2c8ad82cd2f0a2e02fcc2502ee676d24b19d6
                                                  • Opcode Fuzzy Hash: 0e17fe5f4cea8daf7568389822acc92f6502776036f37c0c25bdbbb31a48c6bf
                                                  • Instruction Fuzzy Hash: EC4106B6E01219AFCF05DFA9D9859DEBBF8FF08350F11416AF908A7340E73099408BA4
                                                  Function 00AC159E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117stringregistryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 00AC15DA
                                                  • lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00AC163C
                                                  • lstrlenW.KERNEL32(?), ref: 00AC1648
                                                  • RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00AC168B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen$Value
                                                  • String ID: BundleUpgradeCode$regutil.cpp
                                                  • API String ID: 198323757-1648651458
                                                  • Opcode ID: 579a0e8eef663a087f36a26ae5407738829d4e55bfed36d00a0c6c67a3e2eebb
                                                  • Instruction ID: e0b42a779213ac50e85b933b41597c3e3aabdaed46e21c8ea5bdf16bd8cf49fe
                                                  • Opcode Fuzzy Hash: 579a0e8eef663a087f36a26ae5407738829d4e55bfed36d00a0c6c67a3e2eebb
                                                  • Instruction Fuzzy Hash: BA417172A00229ABCB11DF99CD85EAEBBB8BF45750F0A0559FD11AB211D730ED119BA0
                                                  Function 00AC0523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00AEB5FC,00000000,?,?,?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?), ref: 00AC0533
                                                  • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00AEB5F4,?,00A94207,00000000,Setup), ref: 00AC05D7
                                                  • GetLastError.KERNEL32(?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?,?,?), ref: 00AC05E7
                                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?), ref: 00AC0621
                                                    • Part of subcall function 00A82DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00A82F09
                                                  • LeaveCriticalSection.KERNEL32(00AEB5FC,?,?,00AEB5F4,?,00A94207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00A854FA,?), ref: 00AC067A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                  • String ID: logutil.cpp
                                                  • API String ID: 4111229724-3545173039
                                                  • Opcode ID: 05b3a9fedf84da36dccbda686aff047e86f2d8c11220a36aa112382ba93bd25e
                                                  • Instruction ID: 05f01d587c3e20d661c8c9ef69d02397a690832ea10d14125ae341dd6dd93a4c
                                                  • Opcode Fuzzy Hash: 05b3a9fedf84da36dccbda686aff047e86f2d8c11220a36aa112382ba93bd25e
                                                  • Instruction Fuzzy Hash: EB31D731910269FFDF21DFA5DE8AF6E7A69EB00750F024128F901AB160D7B1CD609BB0
                                                  Function 00AA398D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00AA39F4
                                                  Strings
                                                  • %s%="%s", xrefs: 00AA3A27
                                                  • Failed to append property string part., xrefs: 00AA3A68
                                                  • Failed to format property string part., xrefs: 00AA3A6F
                                                  • Failed to escape string., xrefs: 00AA3A76
                                                  • Failed to format property value., xrefs: 00AA3A7D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16
                                                  • String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
                                                  • API String ID: 3613110473-515423128
                                                  • Opcode ID: d328183d462e7a7d711511927f2a0888857d4db07be6b7f420fb4979b9fe1277
                                                  • Instruction ID: 54030f51e31266a1af7acf3d8998b289d40c8855663b33a81956dc80b0aadd2f
                                                  • Opcode Fuzzy Hash: d328183d462e7a7d711511927f2a0888857d4db07be6b7f420fb4979b9fe1277
                                                  • Instruction Fuzzy Hash: 7C31727390522ABFDF15AF98CD42AAEB778EF01750F10466AF81167290D7719F10DB90
                                                  Function 00AC41E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00AC432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00A9A063,00000001), ref: 00AC4203
                                                  • GetLastError.KERNEL32(00000002,?,00AC432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00A9A063,00000001,000007D0,00000001,00000001,00000003), ref: 00AC4212
                                                  • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,00AC432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00A9A063,00000001), ref: 00AC42A6
                                                  • GetLastError.KERNEL32(?,00AC432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00A9A063,00000001,000007D0,00000001), ref: 00AC42B0
                                                    • Part of subcall function 00AC4440: FindFirstFileW.KERNEL32(00AA923A,?,00000100,00000000,00000000), ref: 00AC447B
                                                    • Part of subcall function 00AC4440: FindClose.KERNEL32(00000000), ref: 00AC4487
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorFindLastMove$CloseFirst
                                                  • String ID: \$fileutil.cpp
                                                  • API String ID: 3479031965-1689471480
                                                  • Opcode ID: 0c21173245bd26cf63d583675e8346f5f176e507f161c7ea8a03e887259c2212
                                                  • Instruction ID: 90f924e4b5864d836c3e3cdf62099fa7790f242f6584dbe8bc7fd13487d8e102
                                                  • Opcode Fuzzy Hash: 0c21173245bd26cf63d583675e8346f5f176e507f161c7ea8a03e887259c2212
                                                  • Instruction Fuzzy Hash: 2231E036A00236ABEB215F99C822FEE7669BF69761F17412DFC009B210D3318C4187E8
                                                  Function 00A8732C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00A85932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 00A8733E
                                                  • LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00A85932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 00A8741D
                                                  Strings
                                                  • Failed to get unformatted string., xrefs: 00A873AE
                                                  • *****, xrefs: 00A873D9, 00A873E6
                                                  • Failed to get variable: %ls, xrefs: 00A8737F
                                                  • Failed to format value '%ls' of variable: %ls, xrefs: 00A873E7
                                                  • Failed to get value as string for variable: %ls, xrefs: 00A8740C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
                                                  • API String ID: 3168844106-2873099529
                                                  • Opcode ID: dfdba9afc95bcdd55dfcfe425b608a8ada1c266f04dceb8088051b6668933cfd
                                                  • Instruction ID: a765b47973e098b0c715ef29a57f68c12c4c12d848c0c86ea46089c1a3d56a0a
                                                  • Opcode Fuzzy Hash: dfdba9afc95bcdd55dfcfe425b608a8ada1c266f04dceb8088051b6668933cfd
                                                  • Instruction Fuzzy Hash: 83318D3294491AFBCF22BF54CC05F9E7A68FF14321F218629FD046A150D771EA60ABE5
                                                  Function 00AC32F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VariantInit.OLEAUT32(?), ref: 00AC3309
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC3325
                                                  • VariantClear.OLEAUT32(?), ref: 00AC33AC
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC33B7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: StringVariant$AllocClearFreeInit
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 760788290-2876128059
                                                  • Opcode ID: 3a8a784f1696c07ac4164e0d5e5e5af0290494cc09e140736d1f65455260e982
                                                  • Instruction ID: 205e730180609c0fbecf9f4209ab17ba246afafee55a0cf45eb5fb7db2ff4eb3
                                                  • Opcode Fuzzy Hash: 3a8a784f1696c07ac4164e0d5e5e5af0290494cc09e140736d1f65455260e982
                                                  • Instruction Fuzzy Hash: 67219136901259AFCF11EF98C949FAEBBB9AF84711F16815CF901AF350CB319E018B91
                                                  Function 00A98DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00A98E37
                                                  • GetLastError.KERNEL32 ref: 00A98E41
                                                  • SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00A98EA1
                                                  Strings
                                                  • Failed to initialize ACL., xrefs: 00A98E6F
                                                  • cache.cpp, xrefs: 00A98E65
                                                  • Failed to allocate administrator SID., xrefs: 00A98E1D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileInitializeLast
                                                  • String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
                                                  • API String ID: 669721577-1117388985
                                                  • Opcode ID: 6161a7a4a05c455a3ac647db4c6cffd4509988b07f1c0417fc2b9fc657a73dd6
                                                  • Instruction ID: 32708c69b50dac3fad315b1c7d1f9aac0adaa73c73c9394b8094152564f8169f
                                                  • Opcode Fuzzy Hash: 6161a7a4a05c455a3ac647db4c6cffd4509988b07f1c0417fc2b9fc657a73dd6
                                                  • Instruction Fuzzy Hash: D621C633B40214B7DF219BD99C46F9FB7A9BF01B10F114129B904BB280EA75DE008690
                                                  Function 00A84212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00A94028,00000001,feclient.dll,?,00000000,?,?,?,00A84B12), ref: 00A8424D
                                                  • GetLastError.KERNEL32(?,?,00A94028,00000001,feclient.dll,?,00000000,?,?,?,00A84B12,?,?,00ACB488,?,00000001), ref: 00A84259
                                                  • GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00A94028,00000001,feclient.dll,?,00000000,?,?,?,00A84B12,?), ref: 00A84294
                                                  • GetLastError.KERNEL32(?,?,00A94028,00000001,feclient.dll,?,00000000,?,?,?,00A84B12,?,?,00ACB488,?,00000001), ref: 00A8429E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentDirectoryErrorLast
                                                  • String ID: crypt32.dll$dirutil.cpp
                                                  • API String ID: 152501406-1104880720
                                                  • Opcode ID: 099be51c3e611220c1907dc4023141a4ab9a60e23e49378e1ba029962ff9f990
                                                  • Instruction ID: 8ccb04bd452cd0a5cf4456e2b1c542232309a0600d25cf60cc8c4cc2bf239768
                                                  • Opcode Fuzzy Hash: 099be51c3e611220c1907dc4023141a4ab9a60e23e49378e1ba029962ff9f990
                                                  • Instruction Fuzzy Hash: ED119D77E05637A79721BBD98C45AABBA58EF19760B160165FE00E7250F721DC0047F0
                                                  Function 00AA0B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA0C2B
                                                  • Unexpected call to CabWrite()., xrefs: 00AA0BC1
                                                  • Failed to write during cabinet extraction., xrefs: 00AA0C35
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastWrite_memcpy_s
                                                  • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                  • API String ID: 1970631241-3111339858
                                                  • Opcode ID: ac0b8c77f0084ca580b501e75d8f73a0ccb7649a87511be6fbf0783a8e7806e6
                                                  • Instruction ID: 39650b2bad81f433762194e2a0690b02b76cde7507943639bb1af4d8be329b65
                                                  • Opcode Fuzzy Hash: ac0b8c77f0084ca580b501e75d8f73a0ccb7649a87511be6fbf0783a8e7806e6
                                                  • Instruction Fuzzy Hash: 0C21CF76540205ABCB10DF5CD985D5A77B9FF89720F214259FE04C7281E732ED00CB60
                                                  Function 00A89AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89AFB
                                                  • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,00000000,?,00A8A8B4,00000100,000002C0,000002C0,00000100), ref: 00A89B10
                                                  • GetLastError.KERNEL32(?,00A8A8B4,00000100,000002C0,000002C0,00000100), ref: 00A89B1B
                                                  Strings
                                                  • Failed while searching directory search: %ls, for path: %ls, xrefs: 00A89B54
                                                  • Failed to format variable string., xrefs: 00A89B06
                                                  • Failed to set variable., xrefs: 00A89B7A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesErrorFileLastOpen@16
                                                  • String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
                                                  • API String ID: 1811509786-402580132
                                                  • Opcode ID: 9d8529227c5944314b7c3e03a5a8e679cff3cd4dca22b87a71af8d428d2aebd5
                                                  • Instruction ID: 63f22456e7226218ae2bc1b21261a7bfb53c17fff1283e549a17f7f10e7be487
                                                  • Opcode Fuzzy Hash: 9d8529227c5944314b7c3e03a5a8e679cff3cd4dca22b87a71af8d428d2aebd5
                                                  • Instruction Fuzzy Hash: 4D11D332940525FBDB227BA8AD8AFBFB668EF00370F250325F910B6190D7219D10A7D5
                                                  Function 00AA0C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00AA0CC4
                                                  • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AA0CD6
                                                  • SetFileTime.KERNEL32(?,?,?,?), ref: 00AA0CE9
                                                  • CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00AA08B1,?,?), ref: 00AA0CF8
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA0C93
                                                  • Invalid operation for this state., xrefs: 00AA0C9D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Time$File$CloseDateHandleLocal
                                                  • String ID: Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 609741386-1751360545
                                                  • Opcode ID: cdecd290a0300ef65407021e0109c54d35d3c40e6b171f9fc89338766186e8ca
                                                  • Instruction ID: ada6a17974b3de65e01a413bd02dcb809dd4f153d38047f1288d44db627cd6a0
                                                  • Opcode Fuzzy Hash: cdecd290a0300ef65407021e0109c54d35d3c40e6b171f9fc89338766186e8ca
                                                  • Instruction Fuzzy Hash: 2E21C07281021ABB8B10DFA8DD09DEABBBCFF05720B108216F865D75D0D371EA11CBA0
                                                  Function 00A94A77 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,crypt32.dll,00000000,00000000,00000000,?,00A9539D), ref: 00A94AC3
                                                  Strings
                                                  • Failed to write message type to pipe., xrefs: 00A94B05
                                                  • crypt32.dll, xrefs: 00A94A7D
                                                  • Failed to allocate message to write., xrefs: 00A94AA2
                                                  • pipe.cpp, xrefs: 00A94AFB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FileWrite
                                                  • String ID: Failed to allocate message to write.$Failed to write message type to pipe.$crypt32.dll$pipe.cpp
                                                  • API String ID: 3934441357-606776022
                                                  • Opcode ID: cd69e677ae1d5eee12b8d59e41a755c13251668c90ae60300e6a772be49be658
                                                  • Instruction ID: 8b839c7c907a460c8cbcb3dcf71e8a216691d62ffde1d20e134b5a788c362ebc
                                                  • Opcode Fuzzy Hash: cd69e677ae1d5eee12b8d59e41a755c13251668c90ae60300e6a772be49be658
                                                  • Instruction Fuzzy Hash: 02119A72A80229BBCF21DF89DD05E9E7BF8EB48790F114166F900B6240E7319E11D7A4
                                                  Function 00A94642 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • _memcpy_s.LIBCMT ref: 00A94693
                                                  • _memcpy_s.LIBCMT ref: 00A946A6
                                                  • _memcpy_s.LIBCMT ref: 00A946C1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: _memcpy_s$Heap$AllocateProcess
                                                  • String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
                                                  • API String ID: 886498622-766083570
                                                  • Opcode ID: cfb7e22510431f9a2673cac88ef56e6e5b13ab8b7014f5e9c53ccfb1b2326a97
                                                  • Instruction ID: 2929efda17c5b5bc5fc03127fe2ab3cc193329e9fc1fba9a8e5f949f4b5fc282
                                                  • Opcode Fuzzy Hash: cfb7e22510431f9a2673cac88ef56e6e5b13ab8b7014f5e9c53ccfb1b2326a97
                                                  • Instruction Fuzzy Hash: 57119EB360020AABDF01AF94CD82DEB73ACEF09B10B00452AFA119B241E771DA5487E0
                                                  Function 00A89A4D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00A89AC4
                                                  Strings
                                                  • `Dv, xrefs: 00A89AC4
                                                  • Condition, xrefs: 00A89A5F
                                                  • Failed to copy condition string from BSTR, xrefs: 00A89AAE
                                                  • Failed to select condition node., xrefs: 00A89A7B
                                                  • Failed to get Condition inner text., xrefs: 00A89A94
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeString
                                                  • String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`Dv
                                                  • API String ID: 3341692771-1896785106
                                                  • Opcode ID: 61a32a8b2f4ab0ff8b0c9ede2b13b261a47992e960972a389c6263626fc7a544
                                                  • Instruction ID: bd2b8f4393f08650f8345e84f1e0334671cb9b783d73690a7788496cbb052aa9
                                                  • Opcode Fuzzy Hash: 61a32a8b2f4ab0ff8b0c9ede2b13b261a47992e960972a389c6263626fc7a544
                                                  • Instruction Fuzzy Hash: 6D11A532945224BBCB19BB94CD06FBEFB78AF04751F564168FC01BA150D7719E01D790
                                                  Function 00A867AA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 00A867E3
                                                  • GetLastError.KERNEL32 ref: 00A867ED
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastPathTemp
                                                  • String ID: 4#v$Failed to get temp path.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 1238063741-2550301277
                                                  • Opcode ID: 9a77fe68fdcc1d095e83dda7c42d1c596727205da5f3425a25a3b861ce5bdfa6
                                                  • Instruction ID: 59a93331c6e9450db5dd718b461e7161183299c3d94042850000c34bd0a607f4
                                                  • Opcode Fuzzy Hash: 9a77fe68fdcc1d095e83dda7c42d1c596727205da5f3425a25a3b861ce5bdfa6
                                                  • Instruction Fuzzy Hash: 0101DB72E4123967D720F7949D06FAA77589B14710F110565FD08FB2C1EB659D0087D5
                                                  Function 00AC96CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                  • API String ID: 0-1718035505
                                                  • Opcode ID: 4ca3d9a054cb6d684f07e7fb6d13bf961c2f7192715b825af332136f4b68b1aa
                                                  • Instruction ID: a163e865dd7fecb6ff1f6f1a5f02794627120698525645aba0ac28f67639df16
                                                  • Opcode Fuzzy Hash: 4ca3d9a054cb6d684f07e7fb6d13bf961c2f7192715b825af332136f4b68b1aa
                                                  • Instruction Fuzzy Hash: AD01F9716632A25B0F218FA66CDDF973398660139231308BEE471D7140DB11C84697A0
                                                  Function 00AC0ACC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00A85EB2,00000000), ref: 00AC0AE0
                                                  • GetProcAddress.KERNEL32(00000000), ref: 00AC0AE7
                                                  • GetLastError.KERNEL32(?,?,?,00A85EB2,00000000), ref: 00AC0AFE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorHandleLastModuleProc
                                                  • String ID: IsWow64Process$kernel32$procutil.cpp
                                                  • API String ID: 4275029093-1586155540
                                                  • Opcode ID: 47af5cb6cb5961cba262ae7b0ca5641eb7683f5666b8ab896583a561ee0d20db
                                                  • Instruction ID: 08f0d61ffe6624b50dd0f07fc2694eb36bfac9edb5ba8acbf3329265c92e2e91
                                                  • Opcode Fuzzy Hash: 47af5cb6cb5961cba262ae7b0ca5641eb7683f5666b8ab896583a561ee0d20db
                                                  • Instruction Fuzzy Hash: 10F0A472A1022AFB8720DBD59D0AE5BBB68FF10B91F024158BD04A7280EB71DD0087E0
                                                  Function 00ABA20B Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00AB3479,00AB3479,?,?,?,00ABA45C,00000001,00000001,ECE85006), ref: 00ABA265
                                                  • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00ABA45C,00000001,00000001,ECE85006,?,?,?), ref: 00ABA2EB
                                                  • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,ECE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00ABA3E5
                                                  • __freea.LIBCMT ref: 00ABA3F2
                                                    • Part of subcall function 00AB521A: HeapAlloc.KERNEL32(00000000,?,?,?,00AB1F87,?,0000015D,?,?,?,?,00AB33E0,000000FF,00000000,?,?), ref: 00AB524C
                                                  • __freea.LIBCMT ref: 00ABA3FB
                                                  • __freea.LIBCMT ref: 00ABA420
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ByteCharMultiWide__freea$AllocHeap
                                                  • String ID:
                                                  • API String ID: 3147120248-0
                                                  • Opcode ID: 69df326ad5ce3ad1ce87a7fb5a1bb8080ef36974cbb524224ed4fad2323fec2b
                                                  • Instruction ID: f0afcfd3048c5b21018ede218a95a74a015255404d897e22b609978b68d1e8ab
                                                  • Opcode Fuzzy Hash: 69df326ad5ce3ad1ce87a7fb5a1bb8080ef36974cbb524224ed4fad2323fec2b
                                                  • Instruction Fuzzy Hash: 72511F32610616AFEB258F64CC81EEF77EDEB64750F254629FD04DA142EB36DC80C6A1
                                                  Function 00A98CAC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00A98D18
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Sleep
                                                  • String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
                                                  • API String ID: 3472027048-398165853
                                                  • Opcode ID: eb9a84902a27c49b9ecc3b90a410c6ab23a9e669b10cefb9faa3cb7de4fb4b3d
                                                  • Instruction ID: e764a81c3577473780c2f31efede3f9c8693ab0313eadd946c29458e2eecd47c
                                                  • Opcode Fuzzy Hash: eb9a84902a27c49b9ecc3b90a410c6ab23a9e669b10cefb9faa3cb7de4fb4b3d
                                                  • Instruction Fuzzy Hash: 7931C472F40214BBEF12A668CE46FBE72AC9F22750F154026FD01F6291DB799E4057A1
                                                  Function 00A9E956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DefWindowProcW.USER32(?,00000082,?,?), ref: 00A9E985
                                                  • SetWindowLongW.USER32(?,000000EB,00000000), ref: 00A9E994
                                                  • SetWindowLongW.USER32(?,000000EB,?), ref: 00A9E9A8
                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 00A9E9B8
                                                  • GetWindowLongW.USER32(?,000000EB), ref: 00A9E9D2
                                                  • PostQuitMessage.USER32(00000000), ref: 00A9EA31
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Window$Long$Proc$MessagePostQuit
                                                  • String ID:
                                                  • API String ID: 3812958022-0
                                                  • Opcode ID: f11d7c886c1e5689d3f94cf02d6e7e8cd7ac6a2acb7154f8eb2e8d847500f635
                                                  • Instruction ID: 43ee5835e4d67c5986025bfb82e10dd002ce1b10a24756cf3ddeadeed384c276
                                                  • Opcode Fuzzy Hash: f11d7c886c1e5689d3f94cf02d6e7e8cd7ac6a2acb7154f8eb2e8d847500f635
                                                  • Instruction Fuzzy Hash: 37218E36204104AFDF11DFA8DD49E6A3BB9FF45351F154618F90AAA2B5C7319D20DB60
                                                  Function 00A9C7C9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Unexpected elevated message sent to child process, msg: %u, xrefs: 00A9C9C4
                                                  • elevation.cpp, xrefs: 00A9C9B8
                                                  • Failed to save state., xrefs: 00A9C891
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandleMutexRelease
                                                  • String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
                                                  • API String ID: 4207627910-1576875097
                                                  • Opcode ID: 58e47ca606e758e619b4775a8ceab34a472427c1f87f979cc47fb3f126df9276
                                                  • Instruction ID: 1665fadaeac0d0ddc37f987fa1a5305727a74c8016d3b6246c0aeefffd070f1f
                                                  • Opcode Fuzzy Hash: 58e47ca606e758e619b4775a8ceab34a472427c1f87f979cc47fb3f126df9276
                                                  • Instruction Fuzzy Hash: 1161C33A200914FFCF129F84CE01D65BBF2FF087247158559FAAA5A632C732E921EB51
                                                  Function 00AC7B16 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7C74
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7C7F
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7C8A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeString$Heap$AllocateProcess
                                                  • String ID: `Dv$atomutil.cpp
                                                  • API String ID: 2724874077-1153537316
                                                  • Opcode ID: d600a570044df3d0950a3ffda601c7f07486b2bfbd960e0b04219dc6bd1b8dbb
                                                  • Instruction ID: b9711c8a106e35bdc53aae2f286f80b9af21ff6dcb35fb395c609560b29b5ac4
                                                  • Opcode Fuzzy Hash: d600a570044df3d0950a3ffda601c7f07486b2bfbd960e0b04219dc6bd1b8dbb
                                                  • Instruction Fuzzy Hash: 7E51527190922AAFCF21DBA4C944FAEB7B8AF44751F164198E905AF250DB71ED00DFA0
                                                  Function 00AC1217 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 150registrystringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00AC123F
                                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00A970E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00AC1276
                                                  • lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00AC136E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue$lstrlen
                                                  • String ID: BundleUpgradeCode$regutil.cpp
                                                  • API String ID: 3790715954-1648651458
                                                  • Opcode ID: 1b70e00f48ca51bb994cbac0eaa880e6f0bf1ce77e040ae4ab138b1fb8f36f6f
                                                  • Instruction ID: 2b992aa3ec550febaa778cc481747886fd54844e94728c201789122570a74079
                                                  • Opcode Fuzzy Hash: 1b70e00f48ca51bb994cbac0eaa880e6f0bf1ce77e040ae4ab138b1fb8f36f6f
                                                  • Instruction Fuzzy Hash: 50418439B0015AEBDB21DF95C884FAEB7B9EB46714F16416EE901EF702D6309D019BA0
                                                  Function 00AC6357 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC490D: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00A98770,00000000,00000000,00000000,00000000,00000000), ref: 00AC4925
                                                    • Part of subcall function 00AC490D: GetLastError.KERNEL32(?,?,?,00A98770,00000000,00000000,00000000,00000000,00000000), ref: 00AC492F
                                                  • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00AC5C09,?,?,?,?,?,?,?,00010000,?), ref: 00AC63C0
                                                  • WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00AC5C09,?,?,?,?), ref: 00AC6412
                                                  • GetLastError.KERNEL32(?,00AC5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00AC6458
                                                  • GetLastError.KERNEL32(?,00AC5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00AC647E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$Write$Pointer
                                                  • String ID: dlutil.cpp
                                                  • API String ID: 133221148-2067379296
                                                  • Opcode ID: 80bd0968582395671487cf6fc3fcd7037e9b56c25264c0784b1f484171bbe3e5
                                                  • Instruction ID: 6b07e9db109125feb231450338bd117d8af5c9d33102834c73740c0dd236793f
                                                  • Opcode Fuzzy Hash: 80bd0968582395671487cf6fc3fcd7037e9b56c25264c0784b1f484171bbe3e5
                                                  • Instruction Fuzzy Hash: 64416F72940229BFDB25CF98CE45FAA7BA9EF04760F164229FD00A6190D771DD60DBA0
                                                  Function 00A82428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • WideCharToMultiByte.KERNEL32(?,00000000,00ABFFEF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00ABFFEF,00AA12CF,?,00000000), ref: 00A8246E
                                                  • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00ABFFEF,00AA12CF,?,00000000,0000FDE9,?,00AA12CF), ref: 00A8247A
                                                    • Part of subcall function 00A83BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BDB
                                                    • Part of subcall function 00A83BD3: HeapSize.KERNEL32(00000000,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BE2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                  • String ID: strutil.cpp
                                                  • API String ID: 3662877508-3612885251
                                                  • Opcode ID: f2eec5b34ab9717fde3e5dc1208ddd8219140ca9988a4fa398686ff45304a9a0
                                                  • Instruction ID: 4bb067c053f03c3ad85e83089123c2412ecc3ea5e9cdc61779dba22489af2015
                                                  • Opcode Fuzzy Hash: f2eec5b34ab9717fde3e5dc1208ddd8219140ca9988a4fa398686ff45304a9a0
                                                  • Instruction Fuzzy Hash: D031D47124021AAFEB14BF698DD4B7637EDBB54764B108229FE119B2A0E776CC019770
                                                  Function 00AAAD44 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00AAADB3
                                                  Strings
                                                  • Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00AAAE4A
                                                  • Failed to extract all payloads from container: %ls, xrefs: 00AAADF7
                                                  • Failed to extract payload: %ls from container: %ls, xrefs: 00AAAE3E
                                                  • Failed to open container: %ls., xrefs: 00AAAD85
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
                                                  • API String ID: 1825529933-3891707333
                                                  • Opcode ID: ca9abe734ad5cced05396d6817ae2655a88e303566d578c1aa81998a897082b1
                                                  • Instruction ID: 52ac0d4947aa152b0ed06f78b04d202d87192825e8233bc3d8ba697473c08ef9
                                                  • Opcode Fuzzy Hash: ca9abe734ad5cced05396d6817ae2655a88e303566d578c1aa81998a897082b1
                                                  • Instruction Fuzzy Hash: C2310232D00225FBCF21ABE4CC46F9E77B8AF15720F204611FA11A71D1E7319A54DBA1
                                                  Function 00AC7A10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7AF4
                                                  • SysFreeString.OLEAUT32(?), ref: 00AC7AFF
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC7B0A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeString$Heap$AllocateProcess
                                                  • String ID: `Dv$atomutil.cpp
                                                  • API String ID: 2724874077-1153537316
                                                  • Opcode ID: 35bdec1875ceef06e6ecb619883cc8e10d3004dbcbc0eeefac9b2b3dcf4de70c
                                                  • Instruction ID: 66435811fc68364605630fda611a354e8a8bcd998a252e4e3ca3b96e68d7e8d6
                                                  • Opcode Fuzzy Hash: 35bdec1875ceef06e6ecb619883cc8e10d3004dbcbc0eeefac9b2b3dcf4de70c
                                                  • Instruction Fuzzy Hash: A6316332D05529BBCB12EB98CD45FAEBBB8EF14790F1241A9E900AB150DB719E019FD0
                                                  Function 00A8F005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,00A90654,00000001,00000001,00000001,00A90654,00000000), ref: 00A8F07D
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,00A90654,00000001,00000001,00000001,00A90654,00000000,00000001,00000000,?,00A90654,00000001), ref: 00A8F09A
                                                  Strings
                                                  • Failed to remove update registration key: %ls, xrefs: 00A8F0C7
                                                  • PackageVersion, xrefs: 00A8F05E
                                                  • Failed to format key for update registration., xrefs: 00A8F033
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCompareString
                                                  • String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
                                                  • API String ID: 446873843-3222553582
                                                  • Opcode ID: fe88fb3133eff7f9cad91289cb9445ebd16c11b8a5ca63b02d9079638124b382
                                                  • Instruction ID: 4a1e60553af43ed1fd7649178ab7d6dd1c1f65ae71be795cfac55f22ffd03d7d
                                                  • Opcode Fuzzy Hash: fe88fb3133eff7f9cad91289cb9445ebd16c11b8a5ca63b02d9079638124b382
                                                  • Instruction Fuzzy Hash: 6B218131D0112AFECB21BBA9CD09FAEBEB8EF01720F114265F915A6151E7319A40D790
                                                  Function 00AC433D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC4440: FindFirstFileW.KERNEL32(00AA923A,?,00000100,00000000,00000000), ref: 00AC447B
                                                    • Part of subcall function 00AC4440: FindClose.KERNEL32(00000000), ref: 00AC4487
                                                  • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00AC4430
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                    • Part of subcall function 00AC1217: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00AC123F
                                                    • Part of subcall function 00AC1217: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00A970E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00AC1276
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseFindQueryValue$FileFirstOpen
                                                  • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
                                                  • API String ID: 3397690329-3978359083
                                                  • Opcode ID: e6eacf8be70496760aab721a57833cf61d9917a0d78ad97e135aa6fab05724bc
                                                  • Instruction ID: 82979bf7e38524851439aa4700405bd6db58ade43f3258531bedf5ed9698c2b8
                                                  • Opcode Fuzzy Hash: e6eacf8be70496760aab721a57833cf61d9917a0d78ad97e135aa6fab05724bc
                                                  • Instruction Fuzzy Hash: B9319131D40209EBDF24AF95CE51FBEBB75EB08750F6681BEE904AA151E3319E40CB54
                                                  Function 00AC4019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CopyFileW.KERNEL32(00000000,00A84DBC,00000000,?,?,00000000,?,00AC412D,00000000,00A84DBC,00000000,00000000,?,00A985EE,?,?), ref: 00AC4033
                                                  • GetLastError.KERNEL32(?,00AC412D,00000000,00A84DBC,00000000,00000000,?,00A985EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00AC4041
                                                  • CopyFileW.KERNEL32(00000000,00A84DBC,00000000,00A84DBC,00000000,?,00AC412D,00000000,00A84DBC,00000000,00000000,?,00A985EE,?,?,00000001), ref: 00AC40AC
                                                  • GetLastError.KERNEL32(?,00AC412D,00000000,00A84DBC,00000000,00000000,?,00A985EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00AC40B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CopyErrorFileLast
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 374144340-2967768451
                                                  • Opcode ID: 7c6fba4f8c545a9ae51b9c7dd94ffb003b2b753ab0e26a501a0eea72cccb5fd1
                                                  • Instruction ID: 61d4d12d934b26ac0ad8938806d446f38ccfb5b4dcfa54a48ffe7adf5a7c76c7
                                                  • Opcode Fuzzy Hash: 7c6fba4f8c545a9ae51b9c7dd94ffb003b2b753ab0e26a501a0eea72cccb5fd1
                                                  • Instruction Fuzzy Hash: 0A21C13668063297AB308B995C60F7B66A8EF18BA1B17053DEF04DB111D7598C4083E9
                                                  Function 00A8EF1B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A8EF56
                                                    • Part of subcall function 00AC4153: SetFileAttributesW.KERNEL32(00AA923A,00000080,00000000,00AA923A,000000FF,00000000,?,?,00AA923A), ref: 00AC4182
                                                    • Part of subcall function 00AC4153: GetLastError.KERNEL32(?,?,00AA923A), ref: 00AC418C
                                                    • Part of subcall function 00A83C6B: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,00A8EFA1,00000001,00000000,00000095,00000001,00A90663,00000095,00000000,swidtag,00000001), ref: 00A83C88
                                                  Strings
                                                  • swidtag, xrefs: 00A8EF65
                                                  • Failed to allocate regid folder path., xrefs: 00A8EFBC
                                                  • Failed to format tag folder path., xrefs: 00A8EFC3
                                                  • Failed to allocate regid file path., xrefs: 00A8EFB5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AttributesDirectoryErrorFileLastOpen@16Remove
                                                  • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
                                                  • API String ID: 1428973842-4170906717
                                                  • Opcode ID: 08030eaab91029d063bbd57c91f3d46028eeef1558a91f13aeb75fa5eb8f1e27
                                                  • Instruction ID: f02852bd9a8d4d291392347618bcdca10537b964d44be328b3254c6980a5e56c
                                                  • Opcode Fuzzy Hash: 08030eaab91029d063bbd57c91f3d46028eeef1558a91f13aeb75fa5eb8f1e27
                                                  • Instruction Fuzzy Hash: 02217831D00528FBCB11EB99CD41B9DFBB5AF44710F1580AAF614AA2A1D731AE81EB90
                                                  Function 00AA8DB6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00AA8E3A
                                                  • RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00A8F7E0,00000001,00000100,000001B4,00000000), ref: 00AA8E88
                                                  Strings
                                                  • SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00AA8DD7
                                                  • Failed to open uninstall registry key., xrefs: 00AA8DFD
                                                  • Failed to enumerate uninstall key for related bundles., xrefs: 00AA8E99
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCompareOpenString
                                                  • String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                                                  • API String ID: 2817536665-2531018330
                                                  • Opcode ID: 35980218070cc2e52b2a8c7ebd30fe78dbf283e88c9ddf91f611da5692885f3c
                                                  • Instruction ID: f725a34124557a38142e837782e491b6bf6462f43e1802b59d85bd7edea37d41
                                                  • Opcode Fuzzy Hash: 35980218070cc2e52b2a8c7ebd30fe78dbf283e88c9ddf91f611da5692885f3c
                                                  • Instruction Fuzzy Hash: 6B21B536940228FFDB21AB94CD46FAEBA79EB01720F254669F510670A0DB398E90D690
                                                  Function 00AAD259 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AAD2EE
                                                  • ReleaseMutex.KERNEL32(?), ref: 00AAD31C
                                                  • SetEvent.KERNEL32(?), ref: 00AAD325
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
                                                  • String ID: Failed to allocate buffer.$NetFxChainer.cpp
                                                  • API String ID: 944053411-3611226795
                                                  • Opcode ID: 79e0783a085ac8083cff1d521e72cc6ff51bbe938658ecc17cd14c53840baa9a
                                                  • Instruction ID: c20d5ba86baf2180339492799a2455f1f40f5b4d5738244192147157139d409b
                                                  • Opcode Fuzzy Hash: 79e0783a085ac8083cff1d521e72cc6ff51bbe938658ecc17cd14c53840baa9a
                                                  • Instruction Fuzzy Hash: 9721E5B1600306FFDB10AF68C845E99B7F5FF08320F108629F9A5A7391C3B1A950CBA0
                                                  Function 00AC5907 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00AA6B11,00000000,?), ref: 00AC591D
                                                  • GetLastError.KERNEL32(?,?,00AA6B11,00000000,?,?,?,?,?,?,?,?,?,00AA6F28,?,?), ref: 00AC592B
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00AA6B11,00000000,?), ref: 00AC5965
                                                  • GetLastError.KERNEL32(?,?,00AA6B11,00000000,?,?,?,?,?,?,?,?,?,00AA6F28,?,?), ref: 00AC596F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ConfigErrorHeapLastQueryService$AllocateProcess
                                                  • String ID: svcutil.cpp
                                                  • API String ID: 355237494-1746323212
                                                  • Opcode ID: f486da3c553c28047215ce00c61665fd0ed3c3f9898cb1c0d854a0c0d05941bf
                                                  • Instruction ID: dcd16149991e4906e350e9128672519942d40ed31272bcf8165bd6f51cbe19a3
                                                  • Opcode Fuzzy Hash: f486da3c553c28047215ce00c61665fd0ed3c3f9898cb1c0d854a0c0d05941bf
                                                  • Instruction Fuzzy Hash: 1C21FF32D41A25F7D731ABA58D05F9FAA69AB40BB0F134098FD05AB210E631AD4092E0
                                                  Function 00AC3245 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC3258
                                                  • VariantInit.OLEAUT32(?), ref: 00AC3264
                                                  • VariantClear.OLEAUT32(?), ref: 00AC32D8
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC32E3
                                                    • Part of subcall function 00AC3498: SysAllocString.OLEAUT32(?), ref: 00AC34AD
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocVariant$ClearFreeInit
                                                  • String ID: `Dv
                                                  • API String ID: 347726874-3059127152
                                                  • Opcode ID: acdb3db8128083dec2f4f497245bb2c20d36107d8197bb15369c3656b128c36b
                                                  • Instruction ID: da84c213ecc7e0982b76510c3816f7ccb3c601a58c8fccd6265f984077ef493e
                                                  • Opcode Fuzzy Hash: acdb3db8128083dec2f4f497245bb2c20d36107d8197bb15369c3656b128c36b
                                                  • Instruction Fuzzy Hash: A2213D32901219AFCF14DBA8C858FEEBBB9EF58715F12815CE8029B210D7319E06CB90
                                                  Function 00A89839 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: _memcpy_s
                                                  • String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
                                                  • API String ID: 2001391462-1605196437
                                                  • Opcode ID: 08e9eea081f62ffb49d9bb568136c34d493e093f01e90f58a735fd40cbaabb42
                                                  • Instruction ID: 2b2bf4f6f98dd0acdcd4858eb24cfb047fb9dd552c3887af31019185201e43f2
                                                  • Opcode Fuzzy Hash: 08e9eea081f62ffb49d9bb568136c34d493e093f01e90f58a735fd40cbaabb42
                                                  • Instruction Fuzzy Hash: FD110A33680221B6DF263E6CDD86EA73A58FF16720F094865FD046E196CA62CD10C7E1
                                                  Function 00A89E16 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 00A89E38
                                                  Strings
                                                  • Failed to format path string., xrefs: 00A89E43
                                                  • File search: %ls, did not find path: %ls, xrefs: 00A89EA3
                                                  • Failed get file version., xrefs: 00A89E78
                                                  • Failed to set variable., xrefs: 00A89E97
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16
                                                  • String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
                                                  • API String ID: 3613110473-2458530209
                                                  • Opcode ID: 247246063a7f95ecb4d515e59cbde7b76a68405f7dc9dbec8fcc9e5f4fddf68f
                                                  • Instruction ID: d7482555cae1daab87e5c055fa7bef84850ed65e58512bba31a7320754a93410
                                                  • Opcode Fuzzy Hash: 247246063a7f95ecb4d515e59cbde7b76a68405f7dc9dbec8fcc9e5f4fddf68f
                                                  • Instruction Fuzzy Hash: 05118E36D40228FE9B12BA98CD82DAFBF78EF14750F15416AF91066211D6319E209B90
                                                  Function 00A9820F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  • CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00A98E17,0000001A,00000000,?,00000000,00000000), ref: 00A98258
                                                  • GetLastError.KERNEL32(?,?,00A98E17,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00A98262
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateCreateErrorKnownLastProcessWell
                                                  • String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
                                                  • API String ID: 2186923214-2110050797
                                                  • Opcode ID: c32e8fe408eafc8e123109ffe74082f5efbde99095671cc9404dadc6f925d31e
                                                  • Instruction ID: bb2e1ac87ead13e08b2d103fb5c845788e29f648fa526e56d186740691c663a2
                                                  • Opcode Fuzzy Hash: c32e8fe408eafc8e123109ffe74082f5efbde99095671cc9404dadc6f925d31e
                                                  • Instruction Fuzzy Hash: B201E933655625B7DA2167998D0AEDB7B9C9F42F70F11401AFD14AB280EE798D0042E4
                                                  Function 00AADDA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00AADDCE
                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00AADDF8
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00AADFC8,00000000,?,?,?,?,00000000), ref: 00AADE00
                                                  Strings
                                                  • bitsuser.cpp, xrefs: 00AADE24
                                                  • Failed while waiting for download., xrefs: 00AADE2E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessageMultipleObjectsPeekWait
                                                  • String ID: Failed while waiting for download.$bitsuser.cpp
                                                  • API String ID: 435350009-228655868
                                                  • Opcode ID: b6e1606c35b13f7efcd7a95e3d26211762e3a20438b7bedc3b83cee16727b03c
                                                  • Instruction ID: ee79fedb2902f6373a8418b7a42e5dd40dc5a2b7524e0e51042b9fcf104cea72
                                                  • Opcode Fuzzy Hash: b6e1606c35b13f7efcd7a95e3d26211762e3a20438b7bedc3b83cee16727b03c
                                                  • Instruction Fuzzy Hash: AE110673A41235B7D7209AA99D09EDBBB6CEB16B20F010125FE46FB5C0D7659D0082E4
                                                  Function 00AC3C72 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ShellExecuteExW.SHELL32(?), ref: 00AC3CC0
                                                  • GetLastError.KERNEL32(?,?,00000000), ref: 00AC3CCA
                                                  • CloseHandle.KERNEL32(?,?,?,00000000), ref: 00AC3CFD
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseErrorExecuteHandleLastShell
                                                  • String ID: <$shelutil.cpp
                                                  • API String ID: 3023784893-3991740012
                                                  • Opcode ID: 1c1d50c7ec8d9cfbaa39be4168c6a3ebe7faa170aec50abfbbda77e2e2d735c8
                                                  • Instruction ID: a691192ee82f75fb8d862879515ea91b28e0c1c620b2eb10f34630af215a93ab
                                                  • Opcode Fuzzy Hash: 1c1d50c7ec8d9cfbaa39be4168c6a3ebe7faa170aec50abfbbda77e2e2d735c8
                                                  • Instruction Fuzzy Hash: A711EA76E01219ABCB10DFA9D945A8E7BF8BF08750F118119FD15F7340E7319A00CBA4
                                                  Function 00A85F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetComputerNameW.KERNEL32(?,00000010), ref: 00A85F5C
                                                  • GetLastError.KERNEL32 ref: 00A85F66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ComputerErrorLastName
                                                  • String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 3560734967-484636765
                                                  • Opcode ID: 21d38dcf1f1f833ce2e4be5f4e81dbc0277e4fdc1cd9790acebda95588ad9db1
                                                  • Instruction ID: 975824f2e3709ad8fdd131f557ce214a4bb94db44cafcc28523062deb65688d7
                                                  • Opcode Fuzzy Hash: 21d38dcf1f1f833ce2e4be5f4e81dbc0277e4fdc1cd9790acebda95588ad9db1
                                                  • Instruction Fuzzy Hash: 2F11A933E455286BD710EBA49D05FDEB7E8AB08720F524455FE01FB280DA75AE0487E5
                                                  Function 00A85E94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(?), ref: 00A85EA6
                                                    • Part of subcall function 00AC0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00A85EB2,00000000), ref: 00AC0AE0
                                                    • Part of subcall function 00AC0ACC: GetProcAddress.KERNEL32(00000000), ref: 00AC0AE7
                                                    • Part of subcall function 00AC0ACC: GetLastError.KERNEL32(?,?,?,00A85EB2,00000000), ref: 00AC0AFE
                                                    • Part of subcall function 00AC3D1F: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00AC3D4C
                                                  Strings
                                                  • Failed to set variant value., xrefs: 00A85F0A
                                                  • variable.cpp, xrefs: 00A85ED0
                                                  • Failed to get shell folder., xrefs: 00A85EDA
                                                  • Failed to get 64-bit folder., xrefs: 00A85EF0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
                                                  • String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 2084161155-3906113122
                                                  • Opcode ID: eab6a9c641df0b95c4901895c77ba00b82d9ec094cc7e1980b9141d429810576
                                                  • Instruction ID: 8e05bf4e64bcf223500cdf083a74961a6abe16404fda0ab3de2d9691f24021bf
                                                  • Opcode Fuzzy Hash: eab6a9c641df0b95c4901895c77ba00b82d9ec094cc7e1980b9141d429810576
                                                  • Instruction Fuzzy Hash: C901C432D41A28BBCF12B7A4CD06FAE7A68AF00760F124169FD04B6180DB719E409BD1
                                                  Function 00AC4153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC4440: FindFirstFileW.KERNEL32(00AA923A,?,00000100,00000000,00000000), ref: 00AC447B
                                                    • Part of subcall function 00AC4440: FindClose.KERNEL32(00000000), ref: 00AC4487
                                                  • SetFileAttributesW.KERNEL32(00AA923A,00000080,00000000,00AA923A,000000FF,00000000,?,?,00AA923A), ref: 00AC4182
                                                  • GetLastError.KERNEL32(?,?,00AA923A), ref: 00AC418C
                                                  • DeleteFileW.KERNEL32(00AA923A,00000000,00AA923A,000000FF,00000000,?,?,00AA923A), ref: 00AC41AC
                                                  • GetLastError.KERNEL32(?,?,00AA923A), ref: 00AC41B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 3967264933-2967768451
                                                  • Opcode ID: 4a88222bdc0d4627ffc29366442ff02e726d375420489922f2bd3004140f2baa
                                                  • Instruction ID: 2e4cb212dfc0a695220833bb9eae4dd301a5cf7d487e58c6b25577b572f1b36f
                                                  • Opcode Fuzzy Hash: 4a88222bdc0d4627ffc29366442ff02e726d375420489922f2bd3004140f2baa
                                                  • Instruction Fuzzy Hash: 1901F932A41735A7D73297AACD25F5B7E98AF28761F070718FD84FB190D7218D8085E8
                                                  Function 00AADA05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00AADA1A
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00AADA5F
                                                  • SetEvent.KERNEL32(?,?,?,?), ref: 00AADA73
                                                  Strings
                                                  • Failure while sending progress during BITS job modification., xrefs: 00AADA4E
                                                  • Failed to get state during job modification., xrefs: 00AADA33
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterEventLeave
                                                  • String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
                                                  • API String ID: 3094578987-1258544340
                                                  • Opcode ID: 10306cec8a4dfc8f8fe70450c767072b51f99841380a785702533b6bcdc6699b
                                                  • Instruction ID: f511b67a92b8281c176894be98f2fe28edfb8fce8a1003d34e574c5479984494
                                                  • Opcode Fuzzy Hash: 10306cec8a4dfc8f8fe70450c767072b51f99841380a785702533b6bcdc6699b
                                                  • Instruction Fuzzy Hash: 3901DE72A04624BFCB11DF59C849EAEB7ACFF06321B018609E806D3A80D731EA45C6E0
                                                  Function 00AADC7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00AADDEE), ref: 00AADC92
                                                  • LeaveCriticalSection.KERNEL32(00000008,?,00AADDEE), ref: 00AADCD7
                                                  • SetEvent.KERNEL32(?,?,00AADDEE), ref: 00AADCEB
                                                  Strings
                                                  • Failure while sending progress., xrefs: 00AADCC6
                                                  • Failed to get BITS job state., xrefs: 00AADCAB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterEventLeave
                                                  • String ID: Failed to get BITS job state.$Failure while sending progress.
                                                  • API String ID: 3094578987-2876445054
                                                  • Opcode ID: 074b48d2481a197088dc318b308a8c4507f91f5da703284b4d70eb6994170383
                                                  • Instruction ID: a15bccb081f8bcf95985b410761c8cf920eec8823e80325c0ca445d464b4fea3
                                                  • Opcode Fuzzy Hash: 074b48d2481a197088dc318b308a8c4507f91f5da703284b4d70eb6994170383
                                                  • Instruction Fuzzy Hash: EA01F572601715BBC711DF5AD949D9AB7ACFF05320B410256F906D3A80DBB1ED50C7E0
                                                  Function 00AAD7E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,00AADF52,?,?,?,?,?,?,00000000,00000000), ref: 00AAD802
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00AADF52,?,?,?,?,?,?,00000000,00000000), ref: 00AAD80D
                                                  • GetLastError.KERNEL32(?,00AADF52,?,?,?,?,?,?,00000000,00000000), ref: 00AAD81A
                                                  Strings
                                                  • bitsuser.cpp, xrefs: 00AAD83E
                                                  • Failed to create BITS job complete event., xrefs: 00AAD848
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateCriticalErrorEventInitializeLastSection
                                                  • String ID: Failed to create BITS job complete event.$bitsuser.cpp
                                                  • API String ID: 3069647169-3441864216
                                                  • Opcode ID: e0604973ae7e0b8af4e71c5ab81813610b6155d5557ec94a114003deab736a50
                                                  • Instruction ID: 85fec043293361dcc901aca1d1e6cdf11f24761f5f6a0b939629d50aaafc132a
                                                  • Opcode Fuzzy Hash: e0604973ae7e0b8af4e71c5ab81813610b6155d5557ec94a114003deab736a50
                                                  • Instruction Fuzzy Hash: 00017576951626BBC3109F5AD905E86BFA8FF09B60F014116FD49E7640D7B49800CBE4
                                                  Function 00A8D4A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00A97040,000000B8,00000000,?,00000000,7694B390), ref: 00A8D4B7
                                                  • InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00A8D4C6
                                                  • LeaveCriticalSection.KERNEL32(000000D0,?,00A97040,000000B8,00000000,?,00000000,7694B390), ref: 00A8D4DB
                                                  Strings
                                                  • userexperience.cpp, xrefs: 00A8D4F4
                                                  • user active cannot be changed because it was already in that state., xrefs: 00A8D4FE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
                                                  • String ID: user active cannot be changed because it was already in that state.$userexperience.cpp
                                                  • API String ID: 3376869089-1544469594
                                                  • Opcode ID: 48d755ab94b17bc3e861e53619d4ac4146a932af9e92ad6f4b6825ea974e9ee2
                                                  • Instruction ID: 61e5566d812b6f8522fad8c3c12bd2a16090127b459356da0d08a29619e43c01
                                                  • Opcode Fuzzy Hash: 48d755ab94b17bc3e861e53619d4ac4146a932af9e92ad6f4b6825ea974e9ee2
                                                  • Instruction Fuzzy Hash: D6F0AF36300208BF9720AFEAEC85D9777ACFB95765705482AB601C3280DA71E9058770
                                                  Function 00AC1C88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00AC1CB3
                                                  • GetLastError.KERNEL32(?,00A849DA,00000001,?,?,00A84551,?,?,?,?,00A85466,?,?,?,?), ref: 00AC1CC2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorLastProc
                                                  • String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
                                                  • API String ID: 199729137-398595594
                                                  • Opcode ID: da08b88901e41f83a66dc9def5b8d66a9cf3b8ef5833f9d5f2210dc063192252
                                                  • Instruction ID: c4ae79c8f325a204d8cf75ec094963002e3ac63de3236a5ae7f08a82834830ea
                                                  • Opcode Fuzzy Hash: da08b88901e41f83a66dc9def5b8d66a9cf3b8ef5833f9d5f2210dc063192252
                                                  • Instruction Fuzzy Hash: 0601D637B95272A3C72367E69C0AF5A25546B127A1F13052AFD01AB252D630DC40C7E5
                                                  Function 00AB495D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AB490E,00000000,?,00AB48AE,00000000,00AE7F08,0000000C,00AB4A05,00000000,00000002), ref: 00AB497D
                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AB4990
                                                  • FreeLibrary.KERNEL32(00000000,?,?,?,00AB490E,00000000,?,00AB48AE,00000000,00AE7F08,0000000C,00AB4A05,00000000,00000002), ref: 00AB49B3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                  • String ID: CorExitProcess$mscoree.dll
                                                  • API String ID: 4061214504-1276376045
                                                  • Opcode ID: 6b5b4d437aa0a18b1e1d21c74ef75124fecafa3910e07aa9c0d5fd1233f52a5e
                                                  • Instruction ID: 2c150bf0f96aef2dde8d7baeb6bdcb8f91b0d795e32d8652aa68f22d60c18010
                                                  • Opcode Fuzzy Hash: 6b5b4d437aa0a18b1e1d21c74ef75124fecafa3910e07aa9c0d5fd1233f52a5e
                                                  • Instruction Fuzzy Hash: 81F04F30A10258BBCB119FA1DC5ABEEBFB9FB08711F054169F805A6192CB765D41CBA1
                                                  Function 00A99287 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 139COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32 ref: 00A993C9
                                                    • Part of subcall function 00AC56CF: GetLastError.KERNEL32(?,?,00A9933A,?,00000003,00000000,?), ref: 00AC56EE
                                                  Strings
                                                  • Failed to get certificate public key identifier., xrefs: 00A993F7
                                                  • cache.cpp, xrefs: 00A993ED
                                                  • Failed to find expected public key in certificate chain., xrefs: 00A9938A
                                                  • Failed to read certificate thumbprint., xrefs: 00A993BD
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast
                                                  • String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
                                                  • API String ID: 1452528299-3408201827
                                                  • Opcode ID: edd7d745c2e1b7a87c05546e45cc7c20cd085084a8afe7ed32a75b3270becd8b
                                                  • Instruction ID: 7c6dd88365d69797af48298a9477b09637ec227c0d64615f797ac69cc3968c43
                                                  • Opcode Fuzzy Hash: edd7d745c2e1b7a87c05546e45cc7c20cd085084a8afe7ed32a75b3270becd8b
                                                  • Instruction Fuzzy Hash: 27412F72B00615BFDF14DFA9C841AAFB7F8BB08710F05416DEA05EB291D675ED008BA4
                                                  Function 00A821AC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A821F2
                                                  • GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A821FE
                                                    • Part of subcall function 00A83BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BDB
                                                    • Part of subcall function 00A83BD3: HeapSize.KERNEL32(00000000,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BE2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                  • String ID: strutil.cpp
                                                  • API String ID: 3662877508-3612885251
                                                  • Opcode ID: 4eb617b79f5c65bf99ac58d9352373219a302c5f37d61cb816f3cc02c77360dc
                                                  • Instruction ID: 68370fe6c7ab1a3a1ced76fa507337287b34cbd8f2662801388d1ae854ed8fcc
                                                  • Opcode Fuzzy Hash: 4eb617b79f5c65bf99ac58d9352373219a302c5f37d61cb816f3cc02c77360dc
                                                  • Instruction Fuzzy Hash: 8131E932611226ABDB20BFA5CC44FBA7BA9AF55764B210325FD159B290FB71DC0087E0
                                                  Function 00AC94FD Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00AC95D5
                                                  • RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00AC9610
                                                  • RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00AC962C
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00AC9639
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00AC9646
                                                    • Part of subcall function 00AC0FD5: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00AC95C2,00000001), ref: 00AC0FED
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close$InfoOpenQuery
                                                  • String ID:
                                                  • API String ID: 796878624-0
                                                  • Opcode ID: 64d421a34514d3f56b94e0f05628f309803492f05e28bc5a329fc83f03faa9c7
                                                  • Instruction ID: 9fe367ae740c6dcf9c06436cb50bc13e5c76f2e389fb3c0cd1a6315d392dff52
                                                  • Opcode Fuzzy Hash: 64d421a34514d3f56b94e0f05628f309803492f05e28bc5a329fc83f03faa9c7
                                                  • Instruction Fuzzy Hash: 95413C76C0162DFFCF22AF98CD85EAEFAB9EF14750F12416DA91076121C7314E509A90
                                                  Function 00A88A07 Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00A88BC8,00A8972D,?,00A8972D,?,?,00A8972D,?,?), ref: 00A88A27
                                                  • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00A88BC8,00A8972D,?,00A8972D,?,?,00A8972D,?,?), ref: 00A88A2F
                                                  • CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00A88BC8,00A8972D,?,00A8972D,?), ref: 00A88A7E
                                                  • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00A88BC8,00A8972D,?,00A8972D,?), ref: 00A88AE0
                                                  • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00A88BC8,00A8972D,?,00A8972D,?), ref: 00A88B0D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString$lstrlen
                                                  • String ID:
                                                  • API String ID: 1657112622-0
                                                  • Opcode ID: 73cccc4e0f564019ef3735281e37c09b7fb97790b0bff33e065ce9a9e3154ee1
                                                  • Instruction ID: 473b63541e79112392c5acb9435e5ce4a6e95dfa7c1b0fb90c977d5d5bc4768a
                                                  • Opcode Fuzzy Hash: 73cccc4e0f564019ef3735281e37c09b7fb97790b0bff33e065ce9a9e3154ee1
                                                  • Instruction Fuzzy Hash: BF318372A01108FFCF25AF58CD899BE7F6AEF48390F568016F90987150CE399D91DBA0
                                                  Function 00A874B7 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00A853BD,WixBundleOriginalSource,?,?,00A9A623,840F01E8,WixBundleOriginalSource,?,00AEAA90,?,00000000,00A85445,00000001,?,?,00A85445), ref: 00A874C3
                                                  • LeaveCriticalSection.KERNEL32(00A853BD,00A853BD,00000000,00000000,?,?,00A9A623,840F01E8,WixBundleOriginalSource,?,00AEAA90,?,00000000,00A85445,00000001,?), ref: 00A8752A
                                                  Strings
                                                  • WixBundleOriginalSource, xrefs: 00A874BF
                                                  • Failed to get value of variable: %ls, xrefs: 00A874FD
                                                  • Failed to get value as string for variable: %ls, xrefs: 00A87519
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
                                                  • API String ID: 3168844106-30613933
                                                  • Opcode ID: 9140a522483101183842bb6936a0f413160ecf3567d126759ac6e0cac4a4bf60
                                                  • Instruction ID: 0bc9368547669459751b9bfc7deccbe32e62544971945be885077b222c60cb7f
                                                  • Opcode Fuzzy Hash: 9140a522483101183842bb6936a0f413160ecf3567d126759ac6e0cac4a4bf60
                                                  • Instruction Fuzzy Hash: 61015A32954129FBCF22AF94CD05E9E3E69EF00771F258165FD04AA220C736DE1197E4
                                                  Function 00AAD152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CloseHandle.KERNEL32(?,00000000,?,00000000,?,00AAD148,00000000), ref: 00AAD16D
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00AAD148,00000000), ref: 00AAD179
                                                  • CloseHandle.KERNEL32(00ACB518,00000000,?,00000000,?,00AAD148,00000000), ref: 00AAD186
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00AAD148,00000000), ref: 00AAD193
                                                  • UnmapViewOfFile.KERNEL32(00ACB4E8,00000000,?,00AAD148,00000000), ref: 00AAD1A2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$FileUnmapView
                                                  • String ID:
                                                  • API String ID: 260491571-0
                                                  • Opcode ID: 677a14c5dc1fe3a9c11c6288084287424dddc0ee8b6b40f651b8cf4181ca49ae
                                                  • Instruction ID: 0f30214367f241acc498f96302036912f68511a1be948454e18450f77ab6be85
                                                  • Opcode Fuzzy Hash: 677a14c5dc1fe3a9c11c6288084287424dddc0ee8b6b40f651b8cf4181ca49ae
                                                  • Instruction Fuzzy Hash: D701E476400B15DFCB31AFA6D98085AF7E9EF517113158A3EE1E762970C372A880CF50
                                                  Function 00AC8713 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00AC8820
                                                  • GetLastError.KERNEL32 ref: 00AC882A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Time$ErrorFileLastSystem
                                                  • String ID: clbcatq.dll$timeutil.cpp
                                                  • API String ID: 2781989572-961924111
                                                  • Opcode ID: 87633fd76f2452ebc46deab6cd9149f3326e4e7a766bd0c304cd1125148bc870
                                                  • Instruction ID: 3a11625b244422ad247c4525521aad7d8489b3da5b066a6756752fd066a79a0f
                                                  • Opcode Fuzzy Hash: 87633fd76f2452ebc46deab6cd9149f3326e4e7a766bd0c304cd1125148bc870
                                                  • Instruction Fuzzy Hash: 2D41E776E4021566DB209BB88D45FBF7779BF90740F66492DB501BB180EE39DE0083A1
                                                  Function 00AC36CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VariantInit.OLEAUT32(000002C0), ref: 00AC36E6
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC36F6
                                                  • VariantClear.OLEAUT32(?), ref: 00AC37D5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Variant$AllocClearInitString
                                                  • String ID: xmlutil.cpp
                                                  • API String ID: 2213243845-1270936966
                                                  • Opcode ID: ae73b8553e6f36181a0965618fee5291070a796c11ccddacc4a58bab22efa27f
                                                  • Instruction ID: 158968d1846724a4716e2792564230ba20db4becd5556aa04d4ffd87c2a3719b
                                                  • Opcode Fuzzy Hash: ae73b8553e6f36181a0965618fee5291070a796c11ccddacc4a58bab22efa27f
                                                  • Instruction Fuzzy Hash: 054158B6900225ABCF11DFA9C888FAFB7B8AF05710F1685A8FD05EF211D635DD008B90
                                                  Function 00AC0E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00AA8E1B), ref: 00AC0EAA
                                                  • RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AA8E1B,00000000), ref: 00AC0EC8
                                                  • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00AA8E1B,00000000,00000000,00000000), ref: 00AC0F1E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Enum$InfoQuery
                                                  • String ID: regutil.cpp
                                                  • API String ID: 73471667-955085611
                                                  • Opcode ID: 48f8f2025e48787b7e904952c303b281c3fccd90d422abf0a933f8195522b8d2
                                                  • Instruction ID: 2b71be208998c25e9d7472de6d1491fe91a69f2ad5d6ed62a9c4d7c3a0f3ec7c
                                                  • Opcode Fuzzy Hash: 48f8f2025e48787b7e904952c303b281c3fccd90d422abf0a933f8195522b8d2
                                                  • Instruction Fuzzy Hash: 2731A176901529FBDB218B98CD84FAFB66DEF04B50F16446DBD00AB110E7718E4097E0
                                                  Function 00AA8B17 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00AA8E57,00000000,00000000), ref: 00AA8BD4
                                                  Strings
                                                  • Failed to open uninstall key for potential related bundle: %ls, xrefs: 00AA8B43
                                                  • Failed to initialize package from related bundle id: %ls, xrefs: 00AA8BBA
                                                  • Failed to ensure there is space for related bundles., xrefs: 00AA8B87
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseOpen
                                                  • String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
                                                  • API String ID: 47109696-1717420724
                                                  • Opcode ID: d540d9d0a90be3ad796576c9a45029d244f4c16ae4ad20bc304666d5ef6cf2b9
                                                  • Instruction ID: fa386959d81576745e33e60f43060a318ac723bc6265f967008708c904dafab6
                                                  • Opcode Fuzzy Hash: d540d9d0a90be3ad796576c9a45029d244f4c16ae4ad20bc304666d5ef6cf2b9
                                                  • Instruction Fuzzy Hash: 1C219DB2940219FBDF129E84CD46FEEBB78EF0A711F104159F911A7190DB759A20EBA0
                                                  Function 00A83B15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,00A81474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00A813B8), ref: 00A83B33
                                                  • HeapReAlloc.KERNEL32(00000000,?,00A81474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00A813B8,000001C7,00000100,?,80004005,00000000), ref: 00A83B3A
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                    • Part of subcall function 00A83BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BDB
                                                    • Part of subcall function 00A83BD3: HeapSize.KERNEL32(00000000,?,00A821CC,000001C7,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83BE2
                                                  • _memcpy_s.LIBCMT ref: 00A83B86
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$Process$AllocAllocateSize_memcpy_s
                                                  • String ID: memutil.cpp
                                                  • API String ID: 3406509257-2429405624
                                                  • Opcode ID: ac3ae0a1abbb469cd4d7b5302b51f1dda59e56e3fb0275caaea55b7fcef342bc
                                                  • Instruction ID: 3261feb4be49d7630bc08b8f712068ead3c0b2b38ac4af4330ec473627b05578
                                                  • Opcode Fuzzy Hash: ac3ae0a1abbb469cd4d7b5302b51f1dda59e56e3fb0275caaea55b7fcef342bc
                                                  • Instruction Fuzzy Hash: 0B11D2B3505118AFCF227F68CD4DD6E3A59EB40F60B054214FD159B262E676CF1093E0
                                                  Function 00AC894D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32 ref: 00AC8991
                                                  • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00AC89B9
                                                  • GetLastError.KERNEL32 ref: 00AC89C3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastTime$FileSystem
                                                  • String ID: inetutil.cpp
                                                  • API String ID: 1528435940-2900720265
                                                  • Opcode ID: b47145487d1e58431b34884ab0b85bdce8dcc36a5da8a64fc2cd02beedbcfef0
                                                  • Instruction ID: 6dfe2e17dfa0ea691e8c90be81dcfe0c24a5589418b2da834aa4579f6cb3fb13
                                                  • Opcode Fuzzy Hash: b47145487d1e58431b34884ab0b85bdce8dcc36a5da8a64fc2cd02beedbcfef0
                                                  • Instruction Fuzzy Hash: F7119373A11139A7D720DBE9CD45FBFBBA8AB44750F020529AE41FB240EA349D0487E2
                                                  Function 00A93AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00A93FB5,feclient.dll,?,00000000,?,?,?,00A84B12), ref: 00A93B42
                                                    • Part of subcall function 00AC10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00AC112B
                                                    • Part of subcall function 00AC10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00AC1163
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue$CloseOpen
                                                  • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                  • API String ID: 1586453840-3596319545
                                                  • Opcode ID: f250144e7634ec601eb115f12975ad02204114ba7730c0e9480e0a96502afbc3
                                                  • Instruction ID: 8f548ac652b41782219bc9d6604bdd108adfd7c420cf06d8f7a22ce2a09400c1
                                                  • Opcode Fuzzy Hash: f250144e7634ec601eb115f12975ad02204114ba7730c0e9480e0a96502afbc3
                                                  • Instruction Fuzzy Hash: 8B11B237B40208BBDF21DB99DD86EAEBBF8EB14750F4040A6E601AB191D6719F81D750
                                                  Function 00AC0764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(00AA12CF,00000000,00000000,?,?,?,00AC0013,00AA12CF,00AA12CF,?,00000000,0000FDE9,?,00AA12CF,8007139F,Invalid operation for this state.), ref: 00AC0776
                                                  • WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,00AC0013,00AA12CF,00AA12CF,?,00000000,0000FDE9,?,00AA12CF,8007139F), ref: 00AC07B2
                                                  • GetLastError.KERNEL32(?,?,00AC0013,00AA12CF,00AA12CF,?,00000000,0000FDE9,?,00AA12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00AC07BC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastWritelstrlen
                                                  • String ID: logutil.cpp
                                                  • API String ID: 606256338-3545173039
                                                  • Opcode ID: 23d7fcfff4e7b9820f3135ea74a897bbd815ed4bd62b5d79d2c14a366f70e6cc
                                                  • Instruction ID: 383cd980061098d095ec21ac7a318b3c1abaf72305ca4e96121861050853778a
                                                  • Opcode Fuzzy Hash: 23d7fcfff4e7b9820f3135ea74a897bbd815ed4bd62b5d79d2c14a366f70e6cc
                                                  • Instruction Fuzzy Hash: CE11A772940624EB8314DBBACD85FABBA6CEB44761F020628FD01EB140D731AD00CAE0
                                                  Function 00A8120A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00A8523F,00000000,?), ref: 00A81248
                                                  • GetLastError.KERNEL32(?,?,?,00A8523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00A81252
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ArgvCommandErrorLastLine
                                                  • String ID: apputil.cpp$ignored
                                                  • API String ID: 3459693003-568828354
                                                  • Opcode ID: 7492d0197858e906e775b817c6c385eaf5ecaaefdb4e94b43d7af78ee1aada5d
                                                  • Instruction ID: c25330f0aaabb0e79100251fa947c83ed253cfeaa0340bbec59c92e28fcabb3f
                                                  • Opcode Fuzzy Hash: 7492d0197858e906e775b817c6c385eaf5ecaaefdb4e94b43d7af78ee1aada5d
                                                  • Instruction Fuzzy Hash: A7116076D11129EB8B21EB99C905DAEBBACAF44760F020169FD04E7210E6319E019BA0
                                                  Function 00AAD1B3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,00AAD3EE,00000000,00000000,00000000,?), ref: 00AAD1C3
                                                  • ReleaseMutex.KERNEL32(?,?,00AAD3EE,00000000,00000000,00000000,?), ref: 00AAD24A
                                                    • Part of subcall function 00A8394F: GetProcessHeap.KERNEL32(?,000001C7,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83960
                                                    • Part of subcall function 00A8394F: RtlAllocateHeap.NTDLL(00000000,?,00A82274,000001C7,00000001,80004005,8007139F,?,?,00AC0267,8007139F,?,00000000,00000000,8007139F), ref: 00A83967
                                                  Strings
                                                  • Failed to allocate memory for message data, xrefs: 00AAD212
                                                  • NetFxChainer.cpp, xrefs: 00AAD208
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
                                                  • String ID: Failed to allocate memory for message data$NetFxChainer.cpp
                                                  • API String ID: 2993511968-1624333943
                                                  • Opcode ID: f4b1168f61a42eb7845b2ef257c5b4cb5bb7baaee68d1345b04dbf63cb1ac46b
                                                  • Instruction ID: 47aa594b6ba3facf04a5dd33e0842674031e53f6fc0582e071bdcc9beecf303e
                                                  • Opcode Fuzzy Hash: f4b1168f61a42eb7845b2ef257c5b4cb5bb7baaee68d1345b04dbf63cb1ac46b
                                                  • Instruction Fuzzy Hash: BC118FB1200215EFCB159FA8D885E9ABBF4FF49720F104164F9159B791C771A810CBA4
                                                  Function 00A81F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • FormatMessageW.KERNEL32(00A8428F,00A8548E,?,00000000,00000000,00000000,?,80070656,?,?,?,00A9E75C,00000000,00A8548E,00000000,80070656), ref: 00A81F9A
                                                  • GetLastError.KERNEL32(?,?,?,00A9E75C,00000000,00A8548E,00000000,80070656,?,?,00A940BF,00A8548E,?,80070656,00000001,crypt32.dll), ref: 00A81FA7
                                                  • LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00A9E75C,00000000,00A8548E,00000000,80070656,?,?,00A940BF,00A8548E), ref: 00A81FEE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFormatFreeLastLocalMessage
                                                  • String ID: strutil.cpp
                                                  • API String ID: 1365068426-3612885251
                                                  • Opcode ID: 64dd2f5d4e2444a53a26f05e563543d17c46e3f9bcb3e572919aead2ec4c8609
                                                  • Instruction ID: 2191990b3e6eeb5017e101967caec53a10b937e5c621669428059928169dd79f
                                                  • Opcode Fuzzy Hash: 64dd2f5d4e2444a53a26f05e563543d17c46e3f9bcb3e572919aead2ec4c8609
                                                  • Instruction Fuzzy Hash: 200182B6910129BBDB10DFD4CD09EDE7AACEB04750F114156BE01F7110E7318E019BE0
                                                  Function 00A90721 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00A90791
                                                  Strings
                                                  • Failed to update name and publisher., xrefs: 00A9077B
                                                  • Failed to open registration key., xrefs: 00A90748
                                                  • Failed to update resume mode., xrefs: 00A90762
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseOpen
                                                  • String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
                                                  • API String ID: 47109696-1865096027
                                                  • Opcode ID: 924676ff23daf64c9e213c321f2c3eab1467fbcfcd90e1a10b4a5b6523c80c0a
                                                  • Instruction ID: e4fcd26aafd4cd248ee70e726402d70e0eda8d94728f246f885734ca40780339
                                                  • Opcode Fuzzy Hash: 924676ff23daf64c9e213c321f2c3eab1467fbcfcd90e1a10b4a5b6523c80c0a
                                                  • Instruction Fuzzy Hash: D1018832A40629FFCF1296D4DD46FEE76B9AB00B70F110155F900B6250D771BE50ABD0
                                                  Function 00AC4DB3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00ACB500,40000000,00000001,00000000,00000002,00000080,00000000,00A904BF,00000000,?,00A8F4F4,?,00000080,00ACB500,00000000), ref: 00AC4DCB
                                                  • GetLastError.KERNEL32(?,00A8F4F4,?,00000080,00ACB500,00000000,?,00A904BF,?,00000094,?,?,?,?,?,00000000), ref: 00AC4DD8
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00A8F4F4,?,00A8F4F4,?,00000080,00ACB500,00000000,?,00A904BF,?,00000094), ref: 00AC4E2C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLast
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 2528220319-2967768451
                                                  • Opcode ID: 08dbdb11aacdadfa30571c218dbee8e276260df4af6b79162198215f521f7b97
                                                  • Instruction ID: ea1e989d52c4727ea57096f9b2f8665b6336af780a86e3ac7f0379b84686c302
                                                  • Opcode Fuzzy Hash: 08dbdb11aacdadfa30571c218dbee8e276260df4af6b79162198215f521f7b97
                                                  • Instruction Fuzzy Hash: 9C01D433641125A7D7329AAD9C16F9F3A54BB49B70F074318FF21AB1D1D7718C0192E4
                                                  Function 00AC497A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00AA8C76,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00AC49AE
                                                  • GetLastError.KERNEL32(?,00AA8C76,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,userVersion,000002C0,000000B0), ref: 00AC49BB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorFileLast
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 1214770103-2967768451
                                                  • Opcode ID: 4260fd36c6543d2d09645178535b1e64c8ae4054bb1afceb4038562ab7f25296
                                                  • Instruction ID: 5b1cf14a76f60df02a4fc168db5d72eee99f93e060247eacf63531ab370083e4
                                                  • Opcode Fuzzy Hash: 4260fd36c6543d2d09645178535b1e64c8ae4054bb1afceb4038562ab7f25296
                                                  • Instruction Fuzzy Hash: EC012633680134B7E72166D5AC1AFAB2A58AB18BB0F134215FF91AF1C0C7754C0052E8
                                                  Function 00AA6BEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49serviceCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ControlService.ADVAPI32(00AA6AFD,00000001,?,00000001,00000000,?,?,?,?,?,?,00AA6AFD,00000000), ref: 00AA6C13
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,00AA6AFD,00000000), ref: 00AA6C1D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ControlErrorLastService
                                                  • String ID: Failed to stop wusa service.$msuuser.cpp
                                                  • API String ID: 4114567744-2259829683
                                                  • Opcode ID: dff4004a1188c83a5e994b87d765201f6982453d9934c1cf96e4e0054a344243
                                                  • Instruction ID: 561abf2106cfd55aaca76c5604d4e64f66bfc1b6a2643f7ab6be35eaddcabb9d
                                                  • Opcode Fuzzy Hash: dff4004a1188c83a5e994b87d765201f6982453d9934c1cf96e4e0054a344243
                                                  • Instruction Fuzzy Hash: 2301A773A4122867DB20DBA99D46EABB7A4EB49B20F014529FD01AB2C0DA659D0186E4
                                                  Function 00AC39AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC39F4
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC3A27
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocFree
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 344208780-2876128059
                                                  • Opcode ID: ff54d69f553cf81ab7f2a7f6cc625d88a67108759af79d9804ab62dcf00f6f57
                                                  • Instruction ID: 3b9ec8d7e9fcaa145fad8a832c5f7c8e223729657b711adea1949187deaf1be7
                                                  • Opcode Fuzzy Hash: ff54d69f553cf81ab7f2a7f6cc625d88a67108759af79d9804ab62dcf00f6f57
                                                  • Instruction Fuzzy Hash: 1201A236644255BBDF205B999C09F6B36ECEF55BA0F128829FC44AB340C6B6CE0187A0
                                                  Function 00AC3929 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC396E
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC39A1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocFree
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 344208780-2876128059
                                                  • Opcode ID: 2760ec291619a82838930ec3e17a9e26bd89ce28f114622a23178965437a727c
                                                  • Instruction ID: 6818b4469e47134ac71802345f64b5e628e666a5f421bf41f6b063fcb2a89e6d
                                                  • Opcode Fuzzy Hash: 2760ec291619a82838930ec3e17a9e26bd89ce28f114622a23178965437a727c
                                                  • Instruction Fuzzy Hash: 2F01A236244255BBDF205B998C05F7B36ECAF51B60F128939FD45EB340C6B0CD0197A1
                                                  Function 00AC68B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysFreeString.OLEAUT32(?), ref: 00AC690F
                                                    • Part of subcall function 00AC8713: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00AC8820
                                                    • Part of subcall function 00AC8713: GetLastError.KERNEL32 ref: 00AC882A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Time$ErrorFileFreeLastStringSystem
                                                  • String ID: `Dv$atomutil.cpp$clbcatq.dll
                                                  • API String ID: 211557998-305513856
                                                  • Opcode ID: cdf113ffa2116b155ba256ac22a351b5212315fecbcb487a4c21886d5c1e5b39
                                                  • Instruction ID: 9ad1c873d2386a1f1e08ca6c3521174f3a59b20ab39d9d5cb20b5da22636ce93
                                                  • Opcode Fuzzy Hash: cdf113ffa2116b155ba256ac22a351b5212315fecbcb487a4c21886d5c1e5b39
                                                  • Instruction Fuzzy Hash: 5801A2B290122AFB8F20EFC5C941E5AFBA8FB18364B62817EF504A7110D3315E10D7D0
                                                  Function 00A9ECC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00A9ECED
                                                  • GetLastError.KERNEL32 ref: 00A9ECF7
                                                  Strings
                                                  • userForApplication.cpp, xrefs: 00A9ED1B
                                                  • Failed to post elevate message., xrefs: 00A9ED25
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessagePostThread
                                                  • String ID: userForApplication.cpp$Failed to post elevate message.
                                                  • API String ID: 2609174426-4098423239
                                                  • Opcode ID: 074f0df742e4156637e7458b83e3fe018099d525da42aba5fef0ab797d956bbb
                                                  • Instruction ID: 6e6fd8d029e266d05ce8c77c761594e0ffae3e544e718581e37819001a304a5f
                                                  • Opcode Fuzzy Hash: 074f0df742e4156637e7458b83e3fe018099d525da42aba5fef0ab797d956bbb
                                                  • Instruction Fuzzy Hash: 64F0F633B40231ABCB20DB989C09E8677D4BF04B74F228629FE54AF282DB25CC0183D4
                                                  Function 00A8D8DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00A8D903
                                                  • FreeLibrary.KERNEL32(?,?,00A848D7,00000000,?,?,00A8548E,?,?), ref: 00A8D912
                                                  • GetLastError.KERNEL32(?,00A848D7,00000000,?,?,00A8548E,?,?), ref: 00A8D91C
                                                  Strings
                                                  • BootstrapperApplicationDestroy, xrefs: 00A8D8FB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorFreeLastLibraryProc
                                                  • String ID: BootstrapperApplicationDestroy
                                                  • API String ID: 1144718084-3186005537
                                                  • Opcode ID: 2aa7bc94e8ba1ad62f030496738db13223c9e8897345975fe47067758d787b6b
                                                  • Instruction ID: fce86e9eb70b0a0b6ac020a94fdc48be15389267b80bf7eae513455f82cbd5c4
                                                  • Opcode Fuzzy Hash: 2aa7bc94e8ba1ad62f030496738db13223c9e8897345975fe47067758d787b6b
                                                  • Instruction Fuzzy Hash: C7F09C32710626ABC3149FA5D805F1AF7A4FF14762B05C229E815D7960D771EC10CBD0
                                                  Function 00AC31EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC3200
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC3230
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocFree
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 344208780-2876128059
                                                  • Opcode ID: fba6426f12741ef40de879b8b309ecc97658ccefd93158802f317a796f663a7d
                                                  • Instruction ID: fd6ab14f26d5f1fc1506d171ebc513614bb2a2eaacc5ad4f519e1adbd36ddf80
                                                  • Opcode Fuzzy Hash: fba6426f12741ef40de879b8b309ecc97658ccefd93158802f317a796f663a7d
                                                  • Instruction Fuzzy Hash: F7F0B432141694A7CF315F889C08FEBB7A8ABA0B60F16C46DFC045B210C7718E1196E0
                                                  Function 00AC3498 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00AC34AD
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC34DD
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocFree
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 344208780-2876128059
                                                  • Opcode ID: 927082834a2dd0a9fb368b0027efa75ba33623c4a2e27f64686326b760d3e11c
                                                  • Instruction ID: 6389f6e8e9df72cf28ff2661c81011d83ee44f5218e4584e295ecd16e20a7385
                                                  • Opcode Fuzzy Hash: 927082834a2dd0a9fb368b0027efa75ba33623c4a2e27f64686326b760d3e11c
                                                  • Instruction Fuzzy Hash: 42F0B432241254ABCF375F489D08F5BB7A8AF81B62F12811AFC145B350C772DE0196E4
                                                  Function 00A9F2D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00A9F2EE
                                                  • GetLastError.KERNEL32 ref: 00A9F2F8
                                                  Strings
                                                  • userForApplication.cpp, xrefs: 00A9F31C
                                                  • Failed to post plan message., xrefs: 00A9F326
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessagePostThread
                                                  • String ID: userForApplication.cpp$Failed to post plan message.
                                                  • API String ID: 2609174426-2952114608
                                                  • Opcode ID: 3c53fc147adc1ef4a62948b1b4b71a1538d365668568390bf17e04abf1f52180
                                                  • Instruction ID: 1ca0b5cec474815f1609048e9efa8202e1d63ce9302d96a98359cf490dc1f154
                                                  • Opcode Fuzzy Hash: 3c53fc147adc1ef4a62948b1b4b71a1538d365668568390bf17e04abf1f52180
                                                  • Instruction Fuzzy Hash: 91F0A733751231BBDA2067E99D0AE8B7FC4FF04B60F024021BE54EF281D665DC0082E4
                                                  Function 00A9F3E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00A9F3FC
                                                  • GetLastError.KERNEL32 ref: 00A9F406
                                                  Strings
                                                  • userForApplication.cpp, xrefs: 00A9F42A
                                                  • Failed to post shutdown message., xrefs: 00A9F434
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessagePostThread
                                                  • String ID: userForApplication.cpp$Failed to post shutdown message.
                                                  • API String ID: 2609174426-188808143
                                                  • Opcode ID: 5afedd3f90321751ba07e33b44a8204411afb4a63668ea37462b460ae874af2f
                                                  • Instruction ID: ac2fa00dd207df8159f3e93501b2b5bfe3e9246ad138b7dcc2a52c66e9a59584
                                                  • Opcode Fuzzy Hash: 5afedd3f90321751ba07e33b44a8204411afb4a63668ea37462b460ae874af2f
                                                  • Instruction Fuzzy Hash: 74F0A7377512357BCA3157D96C0AE877BD4BF44B60F024025BE14FB291E661DC0087E4
                                                  Function 00AA07B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetEvent.KERNEL32(00ACB478,00000000,?,00AA1717,?,00000000,?,00A8C287,?,00A85405,?,00A975A5,?,?,00A85405,?), ref: 00AA07BF
                                                  • GetLastError.KERNEL32(?,00AA1717,?,00000000,?,00A8C287,?,00A85405,?,00A975A5,?,?,00A85405,?,00A85445,00000001), ref: 00AA07C9
                                                  Strings
                                                  • cabextract.cpp, xrefs: 00AA07ED
                                                  • Failed to set begin operation event., xrefs: 00AA07F7
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorEventLast
                                                  • String ID: Failed to set begin operation event.$cabextract.cpp
                                                  • API String ID: 3848097054-4159625223
                                                  • Opcode ID: a93dbe2921e9a1d5b901ca911093e1302fd041eabd4007130a203471d1d46b1f
                                                  • Instruction ID: f453a39a6481e4a3d8c773da39717905e23bc66145cc9ebf29d8dbf08548d58f
                                                  • Opcode Fuzzy Hash: a93dbe2921e9a1d5b901ca911093e1302fd041eabd4007130a203471d1d46b1f
                                                  • Instruction Fuzzy Hash: ADF0EC3754263177862067D95D06ECF76989F06BB0F120125FE01B72C0E735AC00C7E9
                                                  Function 00A9EBCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00A9EBE0
                                                  • GetLastError.KERNEL32 ref: 00A9EBEA
                                                  Strings
                                                  • userForApplication.cpp, xrefs: 00A9EC0E
                                                  • Failed to post apply message., xrefs: 00A9EC18
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessagePostThread
                                                  • String ID: userForApplication.cpp$Failed to post apply message.
                                                  • API String ID: 2609174426-1304321051
                                                  • Opcode ID: 0af685a2f33c2fea53934bdfb389503d789bbeeb361251539a2d47baa3e5f7cb
                                                  • Instruction ID: 0ad09031ccb1be07c2ed3618969b6057542178479725500c529677ad41759731
                                                  • Opcode Fuzzy Hash: 0af685a2f33c2fea53934bdfb389503d789bbeeb361251539a2d47baa3e5f7cb
                                                  • Instruction Fuzzy Hash: 28F08233A51235779A2197999D0EE8BBE88AF05B61B024415FE58BA281D661D80082E4
                                                  Function 00A9EC5C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00A9EC71
                                                  • GetLastError.KERNEL32 ref: 00A9EC7B
                                                  Strings
                                                  • userForApplication.cpp, xrefs: 00A9EC9F
                                                  • Failed to post detect message., xrefs: 00A9ECA9
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessagePostThread
                                                  • String ID: userForApplication.cpp$Failed to post detect message.
                                                  • API String ID: 2609174426-598219917
                                                  • Opcode ID: 7c73f99b5475a969193b208456f7b83a08f3c51af4a4462d02206527754634ac
                                                  • Instruction ID: ac797da8d10e3afb30297488fed861944aa3229b003e8e1d655a73d4f5b349dc
                                                  • Opcode Fuzzy Hash: 7c73f99b5475a969193b208456f7b83a08f3c51af4a4462d02206527754634ac
                                                  • Instruction Fuzzy Hash: 3EF08233641231A79A20D79A9D0AF877F94BF04B60F034411BE58AA281D661DC00C2E4
                                                  Function 00AB6B76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: __alldvrm$_strrchr
                                                  • String ID:
                                                  • API String ID: 1036877536-0
                                                  • Opcode ID: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                  • Instruction ID: 61df413db6fc907e2e2de1bc7495df9b3abd0ef88801c713e2d3dcaf477a7807
                                                  • Opcode Fuzzy Hash: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                  • Instruction Fuzzy Hash: C1A12476A007869FDB21CF28C8917EEBFA9EF16350F1841ADE5859B283C63C9D41C751
                                                  Function 00AC5EC5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen
                                                  • String ID: dlutil.cpp
                                                  • API String ID: 1659193697-2067379296
                                                  • Opcode ID: eec94999df646478d46a1a141dc3931c862367a8cb6ac7488876fc7f67848ee0
                                                  • Instruction ID: 6e9a7c30af60a1b4a02f07ac30c4c85ecf380913032e2cbee67ff8c8992cb21f
                                                  • Opcode Fuzzy Hash: eec94999df646478d46a1a141dc3931c862367a8cb6ac7488876fc7f67848ee0
                                                  • Instruction Fuzzy Hash: 9D518E72D01619ABDB11DFE48D84EAEBBB9AF88710F16812CF900B7250D771ED419BA0
                                                  Function 00AB922B Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • MultiByteToWideChar.KERNEL32(?,00000000,ECE85006,00AB2444,00000000,00000000,00AB3479,?,00AB3479,?,00000001,00AB2444,ECE85006,00000001,00AB3479,00AB3479), ref: 00AB9278
                                                  • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AB9301
                                                  • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00AB9313
                                                  • __freea.LIBCMT ref: 00AB931C
                                                    • Part of subcall function 00AB521A: HeapAlloc.KERNEL32(00000000,?,?,?,00AB1F87,?,0000015D,?,?,?,?,00AB33E0,000000FF,00000000,?,?), ref: 00AB524C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ByteCharMultiWide$AllocHeapStringType__freea
                                                  • String ID:
                                                  • API String ID: 573072132-0
                                                  • Opcode ID: 66fb769ebf6f7ba88ae1058c076383ab15680cbce49a34b9de001179d8df87a1
                                                  • Instruction ID: de4863ecdb9d44c490b3605cc9ddfcb3bd181c1b27e18a57bac43e5875bc9b00
                                                  • Opcode Fuzzy Hash: 66fb769ebf6f7ba88ae1058c076383ab15680cbce49a34b9de001179d8df87a1
                                                  • Instruction Fuzzy Hash: 0F31BD32A0021AABDB24CFA4CC81EEF7BA9EB40710F050128FD04DB192E735CC51CBA0
                                                  Function 00A84FA4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CloseHandle.KERNEL32(?,?,?,00000000,?,00A85552,?,?,?,?,?,?), ref: 00A84FFE
                                                  • DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,00A85552,?,?,?,?,?,?), ref: 00A85012
                                                  • TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00A85552,?,?), ref: 00A85101
                                                  • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00A85552,?,?), ref: 00A85108
                                                    • Part of subcall function 00A81161: LocalFree.KERNEL32(?,?,00A84FBB,?,00000000,?,00A85552,?,?,?,?,?,?), ref: 00A8116B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalDeleteFreeSection$CloseHandleLocal
                                                  • String ID:
                                                  • API String ID: 3671900028-0
                                                  • Opcode ID: 65035ecdf0d1de06d11f32d1d05b48c1e6a034762bbae09286c84aadc97b8d25
                                                  • Instruction ID: 44cf419b788e84e386af623bf03aadddc129c1b899a4acc1e25c5420512a940c
                                                  • Opcode Fuzzy Hash: 65035ecdf0d1de06d11f32d1d05b48c1e6a034762bbae09286c84aadc97b8d25
                                                  • Instruction Fuzzy Hash: 4641FAB1A00B45ABCA30FBB4C949F9B73ECAF04350F44092DB69AD3051EB34F5458B64
                                                  Function 00A84C86 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00A8F96C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00A84CA5,?,?,00000001), ref: 00A8F9BC
                                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00A84D0C
                                                  Strings
                                                  • Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00A84CF6
                                                  • Unable to get resume command line from the registry, xrefs: 00A84CAB
                                                  • Failed to get current process path., xrefs: 00A84CCA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close$Handle
                                                  • String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
                                                  • API String ID: 187904097-642631345
                                                  • Opcode ID: b30f63399b6c327f940a7f6157ff23ee925b96c27a9eae56d97d63ce41e36b50
                                                  • Instruction ID: 1f4b921c75274a806d735dbc3334deb227972cfde0b5183e6a80451ff3c006fd
                                                  • Opcode Fuzzy Hash: b30f63399b6c327f940a7f6157ff23ee925b96c27a9eae56d97d63ce41e36b50
                                                  • Instruction Fuzzy Hash: 11115172D01519FB8F22BB99DD02D9EFBB8EF44710F11419AF810B6211E7329F509B90
                                                  Function 00AB88B2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00AB8A56,00000000,00000000,?,00AB8859,00AB8A56,00000000,00000000,00000000,?,00AB8A56,00000006,FlsSetValue), ref: 00AB88E4
                                                  • GetLastError.KERNEL32(?,00AB8859,00AB8A56,00000000,00000000,00000000,?,00AB8A56,00000006,FlsSetValue,00AE2404,00AE240C,00000000,00000364,?,00AB6230), ref: 00AB88F0
                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00AB8859,00AB8A56,00000000,00000000,00000000,?,00AB8A56,00000006,FlsSetValue,00AE2404,00AE240C,00000000), ref: 00AB88FE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: LibraryLoad$ErrorLast
                                                  • String ID:
                                                  • API String ID: 3177248105-0
                                                  • Opcode ID: 43954c76a3d8e3c484188b0180e7882d26cbe38e414baca7f19b991ac3ac5b31
                                                  • Instruction ID: c8b8fe8d953cb3ec0217864de0a70d558adf9a40e7b4849da4dbea21ab2dbe94
                                                  • Opcode Fuzzy Hash: 43954c76a3d8e3c484188b0180e7882d26cbe38e414baca7f19b991ac3ac5b31
                                                  • Instruction Fuzzy Hash: FE01D432651226ABCF218BAD9C45EAB779CEF05BA1B110620F90AE7141DB25DC01C7F0
                                                  Function 00AB615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(?,00000000,00AB1AEC,00000000,80004004,?,00AB1DF0,00000000,80004004,00000000,00000000), ref: 00AB6162
                                                  • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00AB61CA
                                                  • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00AB61D6
                                                  • _abort.LIBCMT ref: 00AB61DC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$_abort
                                                  • String ID:
                                                  • API String ID: 88804580-0
                                                  • Opcode ID: 95ec4f367a14ad604b7e3295697c00165afe068bb9b664be4f7880ee011a20ef
                                                  • Instruction ID: a65524e77513270bc33fce9bc55f021a7f51012081ec8ca3ead585a0244ade86
                                                  • Opcode Fuzzy Hash: 95ec4f367a14ad604b7e3295697c00165afe068bb9b664be4f7880ee011a20ef
                                                  • Instruction Fuzzy Hash: CFF0A435504A1166C222777D7D0AFEF1A6D8BC1771F260314F918971D3FF2998035125
                                                  Function 00A87435 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00A87441
                                                  • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00A874A8
                                                  Strings
                                                  • Failed to get value of variable: %ls, xrefs: 00A8747B
                                                  • Failed to get value as numeric for variable: %ls, xrefs: 00A87497
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
                                                  • API String ID: 3168844106-4270472870
                                                  • Opcode ID: 21def2ffc270f4961e56d422769ab96e17393c31454abd7ad3fd677d01c6e43a
                                                  • Instruction ID: ada3986b07c9e18b4c0410546f4f12f1a0d21a45d8b1e085c54fd2b8edb22e51
                                                  • Opcode Fuzzy Hash: 21def2ffc270f4961e56d422769ab96e17393c31454abd7ad3fd677d01c6e43a
                                                  • Instruction Fuzzy Hash: 3B017C32945128FBDF12AF98CD09F9EBF69AF00721F218165FD04AA221D736DE5097D0
                                                  Function 00A875AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(?), ref: 00A875B6
                                                  • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00A8761D
                                                  Strings
                                                  • Failed to get value of variable: %ls, xrefs: 00A875F0
                                                  • Failed to get value as version for variable: %ls, xrefs: 00A8760C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
                                                  • API String ID: 3168844106-1851729331
                                                  • Opcode ID: 2dda3852936cba426fd88806e42a1e59f47274ce43c23116d6ef7f10ed73df8a
                                                  • Instruction ID: 10f1783e20a351624eb3787173d4ab3f99f1e945a88a7d6ec6d150f88ac12bc3
                                                  • Opcode Fuzzy Hash: 2dda3852936cba426fd88806e42a1e59f47274ce43c23116d6ef7f10ed73df8a
                                                  • Instruction Fuzzy Hash: 3A018432944528FBCF11AF88CC09F9E7B68EF10721F214165FD04AA121E736DE51A7E4
                                                  Function 00A87539 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00A89897,00000000,?,00000000,00000000,00000000,?,00A896D6,00000000,?,00000000,00000000), ref: 00A87545
                                                  • LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00A89897,00000000,?,00000000,00000000,00000000,?,00A896D6,00000000,?,00000000), ref: 00A8759B
                                                  Strings
                                                  • Failed to get value of variable: %ls, xrefs: 00A8756B
                                                  • Failed to copy value of variable: %ls, xrefs: 00A8758A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave
                                                  • String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
                                                  • API String ID: 3168844106-2936390398
                                                  • Opcode ID: 47cba3ef2d8d4480b192fe6a600f4757fcc228aac95e7835443be30dab297b71
                                                  • Instruction ID: 996241674fd05bf5110404e0e286ecb45b0cab3d66895595409184508809e23d
                                                  • Opcode Fuzzy Hash: 47cba3ef2d8d4480b192fe6a600f4757fcc228aac95e7835443be30dab297b71
                                                  • Instruction Fuzzy Hash: CFF08C32940228BBCF12AF94DD0AE9E3B68EF04361F118124FD04A6220D736DE60ABD0
                                                  Function 00AAE776 Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00AAE788
                                                  • GetCurrentThreadId.KERNEL32 ref: 00AAE797
                                                  • GetCurrentProcessId.KERNEL32 ref: 00AAE7A0
                                                  • QueryPerformanceCounter.KERNEL32(?), ref: 00AAE7AD
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                  • String ID:
                                                  • API String ID: 2933794660-0
                                                  • Opcode ID: 6b778ad25d036d2e50720a62939a4199c15d61c91f2320dccf6c11a0def0d17d
                                                  • Instruction ID: af9174baa78dd1bb0ac263c8dec38fe79d3adc99b4445f680ba03bed2e62f779
                                                  • Opcode Fuzzy Hash: 6b778ad25d036d2e50720a62939a4199c15d61c91f2320dccf6c11a0def0d17d
                                                  • Instruction Fuzzy Hash: B4F09D70C2020CEBCB00DBF4D94AA9EBBF8EF08302F524995A402E7210E735AB059B61
                                                  Function 00AC0C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00AC0DD7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close
                                                  • String ID: regutil.cpp
                                                  • API String ID: 3535843008-955085611
                                                  • Opcode ID: 14415b9f0e583eaa91810480202929b7f4be1a87105eea13f6617a3411b37b0a
                                                  • Instruction ID: 0d93a3222480553d80e3c3189e1c00b3e8f15ed3519c66ddb9733ae8493ad0a0
                                                  • Opcode Fuzzy Hash: 14415b9f0e583eaa91810480202929b7f4be1a87105eea13f6617a3411b37b0a
                                                  • Instruction Fuzzy Hash: 7441C532D0512AEBDF328BD8CD04FAE7B61AB40721F27826CF916AA150D7349D409BD0
                                                  Function 00AC479B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 00AC48FC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseOpen
                                                  • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                  • API String ID: 47109696-3023217399
                                                  • Opcode ID: e14021beab35d936c28243867a2187e9b34a96d4d3d7209ade2d47bd867dde1e
                                                  • Instruction ID: 97a12fcee5606ad58047bad838e0575b5dbefaf2857e19c69c4867d079487660
                                                  • Opcode Fuzzy Hash: e14021beab35d936c28243867a2187e9b34a96d4d3d7209ade2d47bd867dde1e
                                                  • Instruction Fuzzy Hash: 40416D75E00259EFCF20DF98C991FAEBBB9EB48B10F2640ADE500A7251DB319E41DB54
                                                  Function 00AC10B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00AC112B
                                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00AC1163
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue
                                                  • String ID: regutil.cpp
                                                  • API String ID: 3660427363-955085611
                                                  • Opcode ID: 843ace56eec58d8cf40aa7c8cc9e58c0a3e3ffc0d3dee0ba5ba5ce8e8c058b35
                                                  • Instruction ID: 88a98573f11ad830f5b2d2f033b2e79f8c339bce99baac58fce664ecf4ed3e4b
                                                  • Opcode Fuzzy Hash: 843ace56eec58d8cf40aa7c8cc9e58c0a3e3ffc0d3dee0ba5ba5ce8e8c058b35
                                                  • Instruction Fuzzy Hash: 9D419532E0012AEBDB109F99CC41EBEBBB9FF01750F16466DEA10A7151D7359D119790
                                                  Function 00AB66D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • WideCharToMultiByte.KERNEL32(00ACB518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 00AB67A3
                                                  • GetLastError.KERNEL32 ref: 00AB67BF
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ByteCharErrorLastMultiWide
                                                  • String ID: comres.dll
                                                  • API String ID: 203985260-246242247
                                                  • Opcode ID: 9b6ac1da429581a5ab1f4470b9d2d7e24ed911651c61abdb004da320f4d684ed
                                                  • Instruction ID: c6abcbd0b81121168e21eb44784647aab99686c85f95eb238bcc25f7fc18dec1
                                                  • Opcode Fuzzy Hash: 9b6ac1da429581a5ab1f4470b9d2d7e24ed911651c61abdb004da320f4d684ed
                                                  • Instruction Fuzzy Hash: 4531D231600211ABCB21AF55C985FEB7BACEF45764F140169F8148B193EF78CE80C7A1
                                                  Function 00AC8F7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC8E44: lstrlenW.KERNEL32(00000100,?,?,?,00AC9217,000002C0,00000100,00000100,00000100,?,?,?,00AA7D87,?,?,000001BC), ref: 00AC8E69
                                                  • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00ACB500,wininet.dll,?), ref: 00AC907A
                                                  • RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00ACB500,wininet.dll,?), ref: 00AC9087
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                    • Part of subcall function 00AC0E4F: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00AA8E1B), ref: 00AC0EAA
                                                    • Part of subcall function 00AC0E4F: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00AA8E1B,00000000), ref: 00AC0EC8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close$EnumInfoOpenQuerylstrlen
                                                  • String ID: wininet.dll
                                                  • API String ID: 2680864210-3354682871
                                                  • Opcode ID: b7c5bd0a4f3a86b37674c1d94dc26f9c56cc94c26632325b21451297530210b4
                                                  • Instruction ID: ac7f242f8f0abab3f807562572a79d1e292d1f99b7180877bd5157633b9adc4d
                                                  • Opcode Fuzzy Hash: b7c5bd0a4f3a86b37674c1d94dc26f9c56cc94c26632325b21451297530210b4
                                                  • Instruction Fuzzy Hash: 1A311736C01169EFDF21AFA8C984EAFBBB9EF04710B56417DEA11B6121C7319E509B90
                                                  Function 00AC939E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC8E44: lstrlenW.KERNEL32(00000100,?,?,?,00AC9217,000002C0,00000100,00000100,00000100,?,?,?,00AA7D87,?,?,000001BC), ref: 00AC8E69
                                                  • RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00AC9483
                                                  • RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00AC949D
                                                    • Part of subcall function 00AC0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00A9061A,?,00000000,00020006), ref: 00AC0C0E
                                                    • Part of subcall function 00AC14F4: RegSetValueExW.ADVAPI32(00020006,00AD0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00A8F335,00000000,?,00020006), ref: 00AC1527
                                                    • Part of subcall function 00AC14F4: RegDeleteValueW.ADVAPI32(00020006,00AD0D10,00000000,?,?,00A8F335,00000000,?,00020006,?,00AD0D10,00020006,00000000,?,?,?), ref: 00AC1557
                                                    • Part of subcall function 00AC14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00A8F28D,00AD0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 00AC14BB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Value$Close$CreateDeletelstrlen
                                                  • String ID: %ls\%ls
                                                  • API String ID: 3924016894-2125769799
                                                  • Opcode ID: 9331f92b325346cbca296bdf9dd6d6178aafc2fcb0099e6d8757fec24bd1033d
                                                  • Instruction ID: 111a2060cc717d164d186db63120e04a88a17f060fd6263e871bc139551a932d
                                                  • Opcode Fuzzy Hash: 9331f92b325346cbca296bdf9dd6d6178aafc2fcb0099e6d8757fec24bd1033d
                                                  • Instruction Fuzzy Hash: 4A310772C0116DFF8F129FD4CE85D9EBAB9EB04350B06416AE914B6121D7319E51EB90
                                                  Function 00A83A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: _memcpy_s
                                                  • String ID: crypt32.dll$wininet.dll
                                                  • API String ID: 2001391462-82500532
                                                  • Opcode ID: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                  • Instruction ID: ca9b5b7500ce77fc5eaf1281d12a5779ebaf42500c80d548637dd0c8524ffc53
                                                  • Opcode Fuzzy Hash: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                  • Instruction Fuzzy Hash: 1D115172600219AFCF08EF59CDD59ABBF69EF95690B14802AFC054B351D271EA10CBE0
                                                  Function 00AC14F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegSetValueExW.ADVAPI32(00020006,00AD0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00A8F335,00000000,?,00020006), ref: 00AC1527
                                                  • RegDeleteValueW.ADVAPI32(00020006,00AD0D10,00000000,?,?,00A8F335,00000000,?,00020006,?,00AD0D10,00020006,00000000,?,?,?), ref: 00AC1557
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Value$Delete
                                                  • String ID: regutil.cpp
                                                  • API String ID: 1738766685-955085611
                                                  • Opcode ID: c60f83c3f8d348c0af1abcb578baec21c11b1e99ffc67d74575c482bf480d474
                                                  • Instruction ID: 86666389d3a5158a81cccfe25239f956e579f08ef054f2f41d3442a2518c2072
                                                  • Opcode Fuzzy Hash: c60f83c3f8d348c0af1abcb578baec21c11b1e99ffc67d74575c482bf480d474
                                                  • Instruction Fuzzy Hash: 0E110A37F5117EFBDB218B988C05FAB7664EB46760F130529BD02AE151EA31CD1097E0
                                                  Function 00A8DDB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,00AA7691,00000000,IGNOREDEPENDENCIES,00000000,?,00ACB518), ref: 00A8DE04
                                                  Strings
                                                  • Failed to copy the property value., xrefs: 00A8DE38
                                                  • IGNOREDEPENDENCIES, xrefs: 00A8DDBB
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
                                                  • API String ID: 1825529933-1412343224
                                                  • Opcode ID: 2bda7b49d9c0d019a2a70f8637c23b5d55b64ab1f084db7743d9809fedeb9b63
                                                  • Instruction ID: 54031b12771bc0780163ef057135528cd16af0b31f514fdcf5de0a0566820656
                                                  • Opcode Fuzzy Hash: 2bda7b49d9c0d019a2a70f8637c23b5d55b64ab1f084db7743d9809fedeb9b63
                                                  • Instruction Fuzzy Hash: DB118632204215AFDB116F59DC85FAA7BA6BF54320F254279FA19AF2D1C7709850C790
                                                  Function 00AC563F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54sleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00A98E97,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00AC566E
                                                  • SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00A98E97,?), ref: 00AC5689
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: InfoNamedSecuritySleep
                                                  • String ID: aclutil.cpp
                                                  • API String ID: 2352087905-2159165307
                                                  • Opcode ID: e5cd15cc02ed02170023cc47cf65579ad975be0a9d69f54f504f9ca1ca7017f2
                                                  • Instruction ID: e86cae92c4617a7e5dccc71e76b79141a4d412c7a358909dc6f9ff3cf9fdc865
                                                  • Opcode Fuzzy Hash: e5cd15cc02ed02170023cc47cf65579ad975be0a9d69f54f504f9ca1ca7017f2
                                                  • Instruction Fuzzy Hash: 18013C37C01529BBCF229FA9CD05E9EBB65EF44760F0A0259FD0466120C632AD60ABE0
                                                  Function 00A8158C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • LCMapStringW.KERNEL32(0000007F,00000000,00000000,00A970E8,00000000,00A970E8,00000000,00000000,00A970E8,00000000,00000000,00000000,?,00A82318,00000000,00000000), ref: 00A815D0
                                                  • GetLastError.KERNEL32(?,00A82318,00000000,00000000,00A970E8,00000200,?,00AC52B2,00000000,00A970E8,00000000,00A970E8,00000000,00000000,00000000), ref: 00A815DA
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastString
                                                  • String ID: strutil.cpp
                                                  • API String ID: 3728238275-3612885251
                                                  • Opcode ID: 58f18f0927d134c802adb073b0fb298ac2fbd175318d8dd7ee7d83474a423317
                                                  • Instruction ID: b0faf7e895e4e46a877f0a797806c5bcdfd557b1b74a848d1559ae46f7fb1ead
                                                  • Opcode Fuzzy Hash: 58f18f0927d134c802adb073b0fb298ac2fbd175318d8dd7ee7d83474a423317
                                                  • Instruction Fuzzy Hash: 8001B13394123A778B21AE998C45E5B7BACEF85B60F060624FE50BB250E621DC1187E0
                                                  Function 00A957BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CoInitializeEx.OLE32(00000000,00000000), ref: 00A957D9
                                                  • CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00A95833
                                                  Strings
                                                  • Failed to initialize COM on cache thread., xrefs: 00A957E5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: InitializeUninitialize
                                                  • String ID: Failed to initialize COM on cache thread.
                                                  • API String ID: 3442037557-3629645316
                                                  • Opcode ID: 8dbf68c6a4ce7f2a4584431ecb478a5080a34e19cc322fb299dfdcf4db8c1f30
                                                  • Instruction ID: 75d06d9f1e9e6922313d5f1cc3979a74ad4ba3229b35e6c266ba8cc2b9c818c2
                                                  • Opcode Fuzzy Hash: 8dbf68c6a4ce7f2a4584431ecb478a5080a34e19cc322fb299dfdcf4db8c1f30
                                                  • Instruction Fuzzy Hash: D0015B72600619BFCB059BA9D885DD6FBEDFF08350B018126FA09C7221DB31AD149BA0
                                                  Function 00AC3BF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00AC0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00AEAAA0,00000000,?,00AC57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00AC0F80
                                                  • RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00AC3A8E,?), ref: 00AC3C62
                                                  Strings
                                                  • EnableLUA, xrefs: 00AC3C34
                                                  • SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00AC3C0C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseOpen
                                                  • String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
                                                  • API String ID: 47109696-3551287084
                                                  • Opcode ID: 660b3042f423a990d798b4aca8706490d74a1bc0e24202e7721b3dcd03a77e8c
                                                  • Instruction ID: c2f958b227efd25758bd31db087f344b578d0e63334b0a629c7af6f6f63e2934
                                                  • Opcode Fuzzy Hash: 660b3042f423a990d798b4aca8706490d74a1bc0e24202e7721b3dcd03a77e8c
                                                  • Instruction Fuzzy Hash: B2018433911228FBDB109BA4D946FEEF6B8DB14722F2285ADA800B3011D3755F54E6D0
                                                  Function 00A85123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00A81104,?,?,00000000), ref: 00A85142
                                                  • CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00A81104,?,?,00000000), ref: 00A85172
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareStringlstrlen
                                                  • String ID: burn.clean.room
                                                  • API String ID: 1433953587-3055529264
                                                  • Opcode ID: ed6ea84a8d7d7b107e54450ae8c9c9aeeb9c167110800187fc76c2117c51548f
                                                  • Instruction ID: 894ad0c00cd834339f211755036f69939be42a4bffa0303257443e3287554cd9
                                                  • Opcode Fuzzy Hash: ed6ea84a8d7d7b107e54450ae8c9c9aeeb9c167110800187fc76c2117c51548f
                                                  • Instruction Fuzzy Hash: 50018F729106206EC624ABA9ACC8E23BBACEB247A0B104226FD05C7610D331AC52C7A1
                                                  Function 00AC6920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00AC6985
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FreeString
                                                  • String ID: `Dv$atomutil.cpp
                                                  • API String ID: 3341692771-1153537316
                                                  • Opcode ID: 925d9ff0b1da90bc4341ec04e85feaa3c14aba935e15b9846653277f305ea229
                                                  • Instruction ID: 0191a2d10be8d9dee3e6064da99078736912ccda0575a59c3d76ab6f76c9c888
                                                  • Opcode Fuzzy Hash: 925d9ff0b1da90bc4341ec04e85feaa3c14aba935e15b9846653277f305ea229
                                                  • Instruction Fuzzy Hash: BA01D132800114FBCB21EB98CD02FEEF6B8AB44B60F27415DB80066150C7725E00E7E0
                                                  Function 00A86522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(?), ref: 00A86534
                                                    • Part of subcall function 00AC0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00A85EB2,00000000), ref: 00AC0AE0
                                                    • Part of subcall function 00AC0ACC: GetProcAddress.KERNEL32(00000000), ref: 00AC0AE7
                                                    • Part of subcall function 00AC0ACC: GetLastError.KERNEL32(?,?,?,00A85EB2,00000000), ref: 00AC0AFE
                                                    • Part of subcall function 00A85CE2: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00A85D68
                                                  Strings
                                                  • Failed to set variant value., xrefs: 00A86571
                                                  • Failed to get 64-bit folder., xrefs: 00A86557
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
                                                  • String ID: Failed to get 64-bit folder.$Failed to set variant value.
                                                  • API String ID: 3109562764-2681622189
                                                  • Opcode ID: 5388472a8255eb8a7ab5583d25c4b9092298590090192d9ffeabb3958831a6d3
                                                  • Instruction ID: 096cd1734881bbd96bc07a555d267b9195a07aa89049fa5e3e7855a7a5e6418a
                                                  • Opcode Fuzzy Hash: 5388472a8255eb8a7ab5583d25c4b9092298590090192d9ffeabb3958831a6d3
                                                  • Instruction Fuzzy Hash: 36014F32D01228BBDB25BBA4DE06EDEBA78EB00761F164155F80066155D7319F509B90
                                                  Function 00A833C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00A810DD,?,00000000), ref: 00A833E8
                                                  • GetLastError.KERNEL32(?,?,?,?,00A810DD,?,00000000), ref: 00A833FF
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastModuleName
                                                  • String ID: pathutil.cpp
                                                  • API String ID: 2776309574-741606033
                                                  • Opcode ID: 971c45ae0c95300a6992f1fda48fbb2488af0e96bf9f65e9fb8acc30a8684076
                                                  • Instruction ID: f74c601cd85cb7437016000e5934e53a28c7ac1d2b172b09b97109ced037b3ae
                                                  • Opcode Fuzzy Hash: 971c45ae0c95300a6992f1fda48fbb2488af0e96bf9f65e9fb8acc30a8684076
                                                  • Instruction Fuzzy Hash: F3F0C273A41531678B22A69A9C45E9BEA68EB41F71B164121BE44BF110DAA2DD0183F0
                                                  Function 00AAE30F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00AAEBD2
                                                    • Part of subcall function 00AB1380: RaiseException.KERNEL32(?,?,?,00AAEBF4,?,00000000,00000000,?,?,?,?,?,00AAEBF4,?,00AE7EC8), ref: 00AB13DF
                                                  • __CxxThrowException@8.LIBVCRUNTIME ref: 00AAEBEF
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Exception@8Throw$ExceptionRaise
                                                  • String ID: Unknown exception
                                                  • API String ID: 3476068407-410509341
                                                  • Opcode ID: 183a54eebf049cf2ccb35d28721416bd4b9d95de09a4afaff5af156830520ec2
                                                  • Instruction ID: b0937c2fb0093d09b1cccca0b006ff050572a0348422cc4f633841b56b67bb07
                                                  • Opcode Fuzzy Hash: 183a54eebf049cf2ccb35d28721416bd4b9d95de09a4afaff5af156830520ec2
                                                  • Instruction Fuzzy Hash: D1F0F63890030DBBCF00FBA5DD5AD9D776C9E12350B908570F9259B4D2EB70EA55C6E0
                                                  Function 00AC4A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetFileSizeEx.KERNEL32(00000000,00000000,00000000,762334C0,?,?,?,00A8BA1D,?,?,?,00000000,00000000), ref: 00AC4A1D
                                                  • GetLastError.KERNEL32(?,?,?,00A8BA1D,?,?,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00AC4A27
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastSize
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 464720113-2967768451
                                                  • Opcode ID: 821010acd4867b0dad52510190d9373a447c57790323013c870312c8c1f74458
                                                  • Instruction ID: ff31af4186316d431ac806d04ac86898e8fa3c9e29d42464f6d1a6e5d89b0ae2
                                                  • Opcode Fuzzy Hash: 821010acd4867b0dad52510190d9373a447c57790323013c870312c8c1f74458
                                                  • Instruction Fuzzy Hash: 14F04477951136AB97109F89D905E9AFBACFF18B60F02411AFD44A7300E771AD1087E8
                                                  Function 00AC3D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36comCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00A85466,?,00000000,00A85466,?,?,?), ref: 00AC3DA7
                                                  • CoCreateInstance.OLE32(00000000,00000000,00000001,00AE716C,?), ref: 00AC3DBF
                                                  Strings
                                                  • Microsoft.Update.AutoUpdate, xrefs: 00AC3DA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateFromInstanceProg
                                                  • String ID: Microsoft.Update.AutoUpdate
                                                  • API String ID: 2151042543-675569418
                                                  • Opcode ID: b9e2b2d096efe2e81e81424e46f3c85dc3fb4da86c9eb7e2b6f952ef0c0110cc
                                                  • Instruction ID: 96f923ef0a0f8c846be91f331e077d42867998b7cd42d9ede61739c5ea9a0778
                                                  • Opcode Fuzzy Hash: b9e2b2d096efe2e81e81424e46f3c85dc3fb4da86c9eb7e2b6f952ef0c0110cc
                                                  • Instruction Fuzzy Hash: 85F03071610248BBDB00DFE9DD46EAFB7B8EB49710F410565EA01EB150D671AE0587A2
                                                  Function 00AC0E07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00AC0E28
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2202152870.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true
                                                  • Associated: 00000000.00000002.2202126408.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202203138.0000000000ACB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202249529.0000000000AEA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2202274088.0000000000AED000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_a80000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc
                                                  • String ID: AdvApi32.dll$RegDeleteKeyExW
                                                  • API String ID: 190572456-850864035
                                                  • Opcode ID: e78010c578c2f5c63c2fb2d9755fb15e67566b7ccc66e6a8374bd16133f1108a
                                                  • Instruction ID: 577e85590062723ea0d0c7a81615395216298b9874cf6d9f16e614d36cacd9dc
                                                  • Opcode Fuzzy Hash: e78010c578c2f5c63c2fb2d9755fb15e67566b7ccc66e6a8374bd16133f1108a
                                                  • Instruction Fuzzy Hash: 5DE0EC715622E1EACB11EBD5FC8DF437E90B720B59F014924E4049E1B0D7B24842CFB0

                                                  Executed Functions

                                                  Function 0060FEC6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(0063B5FC,00000000,?,?,?,?,005F12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0060FEF4
                                                  • GetCurrentProcessId.KERNEL32(00000000,?,005F12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0060FF04
                                                  • GetCurrentThreadId.KERNEL32 ref: 0060FF0D
                                                  • GetLocalTime.KERNEL32(8007139F,?,005F12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0060FF23
                                                  • LeaveCriticalSection.KERNEL32(0063B5FC,005F12CF,?,00000000,0000FDE9,?,005F12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0061001A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                  • String ID: $ec$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(ec$,ec$0ec
                                                  • API String ID: 296830338-2997396896
                                                  • Opcode ID: f961cdbc7c478c77b650f9e48a7cc6779b04f1ab7bd57c7cfcc66cf2d423d454
                                                  • Instruction ID: 362bb2a1e559ebdf04b2b72a8f82707a1a64f628b59dd8ee84b4917a1de9fe24
                                                  • Opcode Fuzzy Hash: f961cdbc7c478c77b650f9e48a7cc6779b04f1ab7bd57c7cfcc66cf2d423d454
                                                  • Instruction Fuzzy Hash: 8441903190021AABDF25CFA4CC05AFFBBB7EB09711F085025FA00A6290D7348D81CBE0
                                                  Function 005D1070 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 78fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 005D33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005D10DD,?,00000000), ref: 005D33E8
                                                  • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 005D10F6
                                                    • Part of subcall function 005D1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D1186
                                                    • Part of subcall function 005D1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D1191
                                                    • Part of subcall function 005D1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005D119F
                                                    • Part of subcall function 005D1175: GetLastError.KERNEL32(?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D11BA
                                                    • Part of subcall function 005D1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005D11C2
                                                    • Part of subcall function 005D1175: GetLastError.KERNEL32(?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D11D7
                                                  • CloseHandle.KERNEL32(?,?,?,?,0061B4D0,?,0061B460,00000009,?,?,00000000), ref: 005D1131
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                  • String ID: clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                  • API String ID: 3687706282-4271631265
                                                  • Opcode ID: 8a375b19954e38eb2b37dd32eb564f0ffcedd2a6bc0e88343dc1cd0cefee1dbf
                                                  • Instruction ID: 7c2914ece0cd9530759237de77b9cc338acb828ef386278a128a1d565d52915c
                                                  • Opcode Fuzzy Hash: 8a375b19954e38eb2b37dd32eb564f0ffcedd2a6bc0e88343dc1cd0cefee1dbf
                                                  • Instruction Fuzzy Hash: 0E21807190021CABDB20DFE9DC09BEEBFBABB49710F549116EA10B7291D7705944CBA4
                                                  Function 005EA0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed create working folder., xrefs: 005EA0EE
                                                  • Failed to calculate working folder to ensure it exists., xrefs: 005EA0D8
                                                  • Failed to copy working folder., xrefs: 005EA116
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentDirectoryErrorLastProcessWindows
                                                  • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                  • API String ID: 3841436932-2072961686
                                                  • Opcode ID: c4a1e2dbeb6578b4a317a3c69a25f896b3d207a528281ab763a4bb48213c317f
                                                  • Instruction ID: fde5ff6b73605c3243a16165c2adabc31bbae931b45a248b1560ae8f97c3eb7a
                                                  • Opcode Fuzzy Hash: c4a1e2dbeb6578b4a317a3c69a25f896b3d207a528281ab763a4bb48213c317f
                                                  • Instruction Fuzzy Hash: 110188329015B5FB8B269A66DC0AC9EBE76FF94710B114156F84076210DB31AF40FA91
                                                  Function 005DF9E3 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 446COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 0 5df9e3-5dfa14 call 6139af 3 5dfa18-5dfa1a 0->3 4 5dfa16 0->4 5 5dfa1c-5dfa29 call 610237 3->5 6 5dfa2e-5dfa47 call 6132f3 3->6 4->3 13 5dff16-5dff1b 5->13 11 5dfa49-5dfa4e 6->11 12 5dfa53-5dfa68 call 6132f3 6->12 14 5dff0d-5dff14 call 610237 11->14 24 5dfa6a-5dfa6f 12->24 25 5dfa74-5dfa81 call 5dea42 12->25 16 5dff1d-5dff1f 13->16 17 5dff23-5dff28 13->17 30 5dff15 14->30 16->17 20 5dff2a-5dff2c 17->20 21 5dff30-5dff35 17->21 20->21 22 5dff3d-5dff41 21->22 23 5dff37-5dff39 21->23 27 5dff4b-5dff52 22->27 28 5dff43-5dff46 call 615636 22->28 23->22 24->14 33 5dfa8d-5dfaa2 call 6132f3 25->33 34 5dfa83-5dfa88 25->34 28->27 30->13 37 5dfaae-5dfac0 call 614c97 33->37 38 5dfaa4-5dfaa9 33->38 34->14 41 5dfacf-5dfae4 call 6132f3 37->41 42 5dfac2-5dfaca 37->42 38->14 47 5dfae6-5dfaeb 41->47 48 5dfaf0-5dfb05 call 6132f3 41->48 43 5dfd99-5dfda2 call 610237 42->43 43->30 47->14 52 5dfb07-5dfb0c 48->52 53 5dfb11-5dfb23 call 613505 48->53 52->14 56 5dfb2f-5dfb45 call 6139af 53->56 57 5dfb25-5dfb2a 53->57 60 5dfb4b-5dfb4d 56->60 61 5dfdf4-5dfe0e call 5decbe 56->61 57->14 62 5dfb4f-5dfb54 60->62 63 5dfb59-5dfb6e call 613505 60->63 68 5dfe1a-5dfe32 call 6139af 61->68 69 5dfe10-5dfe15 61->69 62->14 70 5dfb7a-5dfb8f call 6132f3 63->70 71 5dfb70-5dfb75 63->71 76 5dfefc-5dfefd call 5df0f8 68->76 77 5dfe38-5dfe3a 68->77 69->14 79 5dfb9f-5dfbb4 call 6132f3 70->79 80 5dfb91-5dfb93 70->80 71->14 83 5dff02-5dff06 76->83 81 5dfe3c-5dfe41 77->81 82 5dfe46-5dfe64 call 6132f3 77->82 90 5dfbc4-5dfbd9 call 6132f3 79->90 91 5dfbb6-5dfbb8 79->91 80->79 84 5dfb95-5dfb9a 80->84 81->14 92 5dfe66-5dfe6b 82->92 93 5dfe70-5dfe88 call 6132f3 82->93 83->30 87 5dff08 83->87 84->14 87->14 101 5dfbe9-5dfbfe call 6132f3 90->101 102 5dfbdb-5dfbdd 90->102 91->90 94 5dfbba-5dfbbf 91->94 92->14 99 5dfe8a-5dfe8c 93->99 100 5dfe95-5dfead call 6132f3 93->100 94->14 99->100 103 5dfe8e-5dfe93 99->103 109 5dfeaf-5dfeb1 100->109 110 5dfeba-5dfed2 call 6132f3 100->110 111 5dfc0e-5dfc23 call 6132f3 101->111 112 5dfc00-5dfc02 101->112 102->101 104 5dfbdf-5dfbe4 102->104 103->14 104->14 109->110 113 5dfeb3-5dfeb8 109->113 119 5dfedb-5dfef3 call 6132f3 110->119 120 5dfed4-5dfed9 110->120 121 5dfc25-5dfc27 111->121 122 5dfc33-5dfc48 call 6132f3 111->122 112->111 114 5dfc04-5dfc09 112->114 113->14 114->14 119->76 128 5dfef5-5dfefa 119->128 120->14 121->122 125 5dfc29-5dfc2e 121->125 129 5dfc58-5dfc6d call 6132f3 122->129 130 5dfc4a-5dfc4c 122->130 125->14 128->14 134 5dfc7d-5dfc92 call 6132f3 129->134 135 5dfc6f-5dfc71 129->135 130->129 131 5dfc4e-5dfc53 130->131 131->14 139 5dfc94-5dfc96 134->139 140 5dfca2-5dfcba call 6132f3 134->140 135->134 136 5dfc73-5dfc78 135->136 136->14 139->140 142 5dfc98-5dfc9d 139->142 144 5dfcbc-5dfcbe 140->144 145 5dfcca-5dfce2 call 6132f3 140->145 142->14 144->145 146 5dfcc0-5dfcc5 144->146 149 5dfce4-5dfce6 145->149 150 5dfcf2-5dfd07 call 6132f3 145->150 146->14 149->150 151 5dfce8-5dfced 149->151 154 5dfd0d-5dfd2a CompareStringW 150->154 155 5dfda7-5dfda9 150->155 151->14 158 5dfd2c-5dfd32 154->158 159 5dfd34-5dfd49 CompareStringW 154->159 156 5dfdab-5dfdb2 155->156 157 5dfdb4-5dfdb6 155->157 156->157 160 5dfdb8-5dfdbd 157->160 161 5dfdc2-5dfdda call 613505 157->161 162 5dfd75-5dfd7a 158->162 163 5dfd4b-5dfd55 159->163 164 5dfd57-5dfd6c CompareStringW 159->164 160->14 161->61 170 5dfddc-5dfdde 161->170 162->157 163->162 165 5dfd7c-5dfd94 call 5d3821 164->165 166 5dfd6e 164->166 165->43 166->162 172 5dfdea 170->172 173 5dfde0-5dfde5 170->173 172->61 173->14
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: StringVariant$AllocClearFreeInit
                                                  • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ET]$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$clbcatq.dll$msasn1.dll$registration.cpp$yes
                                                  • API String ID: 760788290-3471679615
                                                  • Opcode ID: b4d746a898d78f351565114ea6d3675ddf54121533b1f4510a0d895c368a5713
                                                  • Instruction ID: 3b537af5f6d7e8b60cf56262f96aa8601b6571aabe06f99a2dd7a889edbc769b
                                                  • Opcode Fuzzy Hash: b4d746a898d78f351565114ea6d3675ddf54121533b1f4510a0d895c368a5713
                                                  • Instruction Fuzzy Hash: 82E1DA32E48A76BACB31A668DC42EAD7E967B11710F160237FD13FA351C7615E909BC0
                                                  Function 005DB48B Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 578fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 174 5db48b-5db500 call 5ff8e0 * 2 179 5db538-5db53e 174->179 180 5db502-5db50c GetLastError 174->180 183 5db540 179->183 184 5db542-5db554 SetFilePointerEx 179->184 181 5db50e-5db517 180->181 182 5db519 180->182 181->182 185 5db51b 182->185 186 5db520-5db52d call 5d3821 182->186 183->184 187 5db588-5db5a2 ReadFile 184->187 188 5db556-5db560 GetLastError 184->188 185->186 204 5db532-5db533 186->204 189 5db5d9-5db5e0 187->189 190 5db5a4-5db5ae GetLastError 187->190 192 5db56d 188->192 193 5db562-5db56b 188->193 197 5dbbd7-5dbbeb call 5d3821 189->197 198 5db5e6-5db5ef 189->198 194 5db5bb 190->194 195 5db5b0-5db5b9 190->195 199 5db56f 192->199 200 5db574-5db586 call 5d3821 192->200 193->192 202 5db5bd 194->202 203 5db5c2-5db5d4 call 5d3821 194->203 195->194 216 5dbbf0 197->216 198->197 206 5db5f5-5db605 SetFilePointerEx 198->206 199->200 200->204 202->203 203->204 209 5dbbf1-5dbbf7 call 610237 204->209 211 5db63c-5db654 ReadFile 206->211 212 5db607-5db611 GetLastError 206->212 232 5dbbf8-5dbc0a call 5fe06f 209->232 213 5db68b-5db692 211->213 214 5db656-5db660 GetLastError 211->214 218 5db61e 212->218 219 5db613-5db61c 212->219 225 5dbbbc-5dbbd5 call 5d3821 213->225 226 5db698-5db6a2 213->226 222 5db66d 214->222 223 5db662-5db66b 214->223 216->209 220 5db625-5db632 call 5d3821 218->220 221 5db620 218->221 219->218 220->211 221->220 230 5db66f 222->230 231 5db674-5db681 call 5d3821 222->231 223->222 225->216 226->225 227 5db6a8-5db6cb SetFilePointerEx 226->227 234 5db6cd-5db6d7 GetLastError 227->234 235 5db702-5db71a ReadFile 227->235 230->231 231->213 240 5db6d9-5db6e2 234->240 241 5db6e4 234->241 242 5db71c-5db726 GetLastError 235->242 243 5db751-5db769 ReadFile 235->243 240->241 247 5db6eb-5db6f8 call 5d3821 241->247 248 5db6e6 241->248 249 5db728-5db731 242->249 250 5db733 242->250 245 5db76b-5db775 GetLastError 243->245 246 5db7a0-5db7bb SetFilePointerEx 243->246 251 5db777-5db780 245->251 252 5db782 245->252 254 5db7bd-5db7c7 GetLastError 246->254 255 5db7f5-5db814 ReadFile 246->255 247->235 248->247 249->250 256 5db73a-5db747 call 5d3821 250->256 257 5db735 250->257 251->252 260 5db789-5db796 call 5d3821 252->260 261 5db784 252->261 263 5db7c9-5db7d2 254->263 264 5db7d4 254->264 258 5dbb7d-5dbb87 GetLastError 255->258 259 5db81a-5db81c 255->259 256->243 257->256 269 5dbb89-5dbb92 258->269 270 5dbb94 258->270 267 5db81d-5db824 259->267 260->246 261->260 263->264 271 5db7db-5db7eb call 5d3821 264->271 272 5db7d6 264->272 274 5dbb58-5dbb75 call 5d3821 267->274 275 5db82a-5db836 267->275 269->270 277 5dbb9b-5dbbb1 call 5d3821 270->277 278 5dbb96 270->278 271->255 272->271 290 5dbb7a-5dbb7b 274->290 282 5db838-5db83f 275->282 283 5db841-5db84a 275->283 289 5dbbb2-5dbbba call 610237 277->289 278->277 282->283 286 5db884-5db88b 282->286 287 5dbb1b-5dbb32 call 5d3821 283->287 288 5db850-5db876 ReadFile 283->288 292 5db88d-5db8af call 5d3821 286->292 293 5db8b4-5db8cb call 5d394f 286->293 302 5dbb37-5dbb3d call 610237 287->302 288->258 291 5db87c-5db882 288->291 289->232 290->289 291->267 292->290 304 5db8cd-5db8ea call 5d3821 293->304 305 5db8ef-5db904 SetFilePointerEx 293->305 310 5dbb43-5dbb44 302->310 304->209 308 5db944-5db969 ReadFile 305->308 309 5db906-5db910 GetLastError 305->309 311 5db96b-5db975 GetLastError 308->311 312 5db9a0-5db9ac 308->312 314 5db91d 309->314 315 5db912-5db91b 309->315 316 5dbb45-5dbb47 310->316 317 5db977-5db980 311->317 318 5db982 311->318 319 5db9cf-5db9d3 312->319 320 5db9ae-5db9ca call 5d3821 312->320 321 5db91f 314->321 322 5db924-5db934 call 5d3821 314->322 315->314 316->232 323 5dbb4d-5dbb53 call 5d3a16 316->323 317->318 324 5db989-5db99e call 5d3821 318->324 325 5db984 318->325 328 5dba0e-5dba21 call 614a05 319->328 329 5db9d5-5dba09 call 5d3821 call 610237 319->329 320->302 321->322 340 5db939-5db93f call 610237 322->340 323->232 324->340 325->324 342 5dba2d-5dba37 328->342 343 5dba23-5dba28 328->343 329->316 340->310 347 5dba39-5dba3f 342->347 348 5dba41-5dba49 342->348 343->340 349 5dba5a-5dbaba call 5d394f 347->349 350 5dba4b-5dba53 348->350 351 5dba55-5dba58 348->351 354 5dbabc-5dbad8 call 5d3821 349->354 355 5dbade-5dbaff call 5ff360 call 5db208 349->355 350->349 351->349 354->355 355->316 362 5dbb01-5dbb11 call 5d3821 355->362 362->287
                                                  APIs
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 005DB502
                                                  • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB550
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 005DB556
                                                  • ReadFile.KERNELBASE(00000000,aD]H,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB59E
                                                  • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 005DB5A4
                                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB601
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB607
                                                  • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB650
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB656
                                                  • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB6C7
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB6CD
                                                  • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB716
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB71C
                                                  • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB765
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB76B
                                                  • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB7B7
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB7BD
                                                    • Part of subcall function 005D394F: GetProcessHeap.KERNEL32(?,000001C7,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3960
                                                    • Part of subcall function 005D394F: RtlAllocateHeap.NTDLL(00000000,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3967
                                                  • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB810
                                                  • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB872
                                                  • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB8FC
                                                  • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 005DB906
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                  • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$aD]H$burn$section.cpp
                                                  • API String ID: 3411815225-268664109
                                                  • Opcode ID: 6ab387712a0a5ac6b03fddfde0c922bd6710f5a1369c928bf9e0befca23d8289
                                                  • Instruction ID: bef18dba3d493ca07feddfd38bc185ea95a2dc7c6f39f89f842d48cc155d0464
                                                  • Opcode Fuzzy Hash: 6ab387712a0a5ac6b03fddfde0c922bd6710f5a1369c928bf9e0befca23d8289
                                                  • Instruction Fuzzy Hash: 7912D576A41225EBEB309B588C45FEA7EA6BB44B10F064197FD04AB380E771DD80DBD1
                                                  Function 005F0D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 365 5f0d16-5f0d2d SetEvent 366 5f0d6f-5f0d7d WaitForSingleObject 365->366 367 5f0d2f-5f0d39 GetLastError 365->367 370 5f0d7f-5f0d89 GetLastError 366->370 371 5f0db4-5f0dbf ResetEvent 366->371 368 5f0d3b-5f0d44 367->368 369 5f0d46 367->369 368->369 372 5f0d4d-5f0d5d call 5d3821 369->372 373 5f0d48 369->373 376 5f0d8b-5f0d94 370->376 377 5f0d96 370->377 374 5f0df9-5f0dff 371->374 375 5f0dc1-5f0dcb GetLastError 371->375 395 5f0d62-5f0d6a call 610237 372->395 373->372 383 5f0e32-5f0e4b call 5d21ac 374->383 384 5f0e01-5f0e04 374->384 380 5f0dcd-5f0dd6 375->380 381 5f0dd8 375->381 376->377 378 5f0d9d-5f0db2 call 5d3821 377->378 379 5f0d98 377->379 378->395 379->378 380->381 387 5f0ddf-5f0df4 call 5d3821 381->387 388 5f0dda 381->388 399 5f0e4d-5f0e5e call 610237 383->399 400 5f0e63-5f0e6e SetEvent 383->400 390 5f0e28-5f0e2d 384->390 391 5f0e06-5f0e23 call 5d3821 384->391 387->395 388->387 392 5f10e8-5f10ed 390->392 405 5f10de-5f10e4 call 610237 391->405 401 5f10ef 392->401 402 5f10f2-5f10f8 392->402 395->392 419 5f10e5-5f10e7 399->419 407 5f0ea8-5f0eb6 WaitForSingleObject 400->407 408 5f0e70-5f0e7a GetLastError 400->408 401->402 405->419 410 5f0eb8-5f0ec2 GetLastError 407->410 411 5f0ef0-5f0efb ResetEvent 407->411 414 5f0e7c-5f0e85 408->414 415 5f0e87 408->415 416 5f0ecf 410->416 417 5f0ec4-5f0ecd 410->417 420 5f0efd-5f0f07 GetLastError 411->420 421 5f0f35-5f0f3c 411->421 414->415 422 5f0e8e-5f0ea3 call 5d3821 415->422 423 5f0e89 415->423 426 5f0ed6-5f0eeb call 5d3821 416->426 427 5f0ed1 416->427 417->416 419->392 428 5f0f09-5f0f12 420->428 429 5f0f14 420->429 424 5f0f3e-5f0f41 421->424 425 5f0fab-5f0fce CreateFileW 421->425 439 5f10dd 422->439 423->422 433 5f0f6e-5f0f72 call 5d394f 424->433 434 5f0f43-5f0f46 424->434 431 5f100b-5f101f SetFilePointerEx 425->431 432 5f0fd0-5f0fda GetLastError 425->432 426->439 427->426 428->429 436 5f0f1b-5f0f30 call 5d3821 429->436 437 5f0f16 429->437 445 5f1059-5f1064 SetEndOfFile 431->445 446 5f1021-5f102b GetLastError 431->446 440 5f0fdc-5f0fe5 432->440 441 5f0fe7 432->441 457 5f0f77-5f0f7c 433->457 442 5f0f48-5f0f4b 434->442 443 5f0f67-5f0f69 434->443 436->439 437->436 439->405 440->441 451 5f0fee-5f1001 call 5d3821 441->451 452 5f0fe9 441->452 453 5f0f5d-5f0f62 442->453 454 5f0f4d-5f0f53 442->454 443->392 449 5f109b-5f10a8 SetFilePointerEx 445->449 450 5f1066-5f1070 GetLastError 445->450 455 5f102d-5f1036 446->455 456 5f1038 446->456 449->419 462 5f10aa-5f10b4 GetLastError 449->462 459 5f107d 450->459 460 5f1072-5f107b 450->460 451->431 452->451 453->419 454->453 455->456 465 5f103f-5f1054 call 5d3821 456->465 466 5f103a 456->466 463 5f0f7e-5f0f98 call 5d3821 457->463 464 5f0f9d-5f0fa6 457->464 467 5f107f 459->467 468 5f1084-5f1099 call 5d3821 459->468 460->459 470 5f10b6-5f10bf 462->470 471 5f10c1 462->471 463->439 464->419 465->439 466->465 467->468 468->439 470->471 475 5f10c8-5f10d8 call 5d3821 471->475 476 5f10c3 471->476 475->439 476->475
                                                  APIs
                                                  • SetEvent.KERNEL32(?,?,?,?,?,005F08BC,?,?), ref: 005F0D25
                                                  • GetLastError.KERNEL32(?,?,?,?,005F08BC,?,?), ref: 005F0D2F
                                                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,005F08BC,?,?), ref: 005F0D74
                                                  • GetLastError.KERNEL32(?,?,?,?,005F08BC,?,?), ref: 005F0D7F
                                                  • ResetEvent.KERNEL32(?,?,?,?,?,005F08BC,?,?), ref: 005F0DB7
                                                  • GetLastError.KERNEL32(?,?,?,?,005F08BC,?,?), ref: 005F0DC1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                  • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 1865021742-2104912459
                                                  • Opcode ID: a2a9afb04e4104728dec08773c3a25cb4db49dcd6ba871af92e867301092f297
                                                  • Instruction ID: 28d40d2a4a6a3b387c42eff697a9c2f0eed663e932bc724ece161e7a11204b4f
                                                  • Opcode Fuzzy Hash: a2a9afb04e4104728dec08773c3a25cb4db49dcd6ba871af92e867301092f297
                                                  • Instruction Fuzzy Hash: F9917937A81A3AA7D33016E94D0DB7A2D56BF04B21F175616FF00BE2C1DBA8DC0096D6
                                                  Function 005D5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 587 5d5195-5d5243 call 5ff8e0 * 2 GetModuleHandleW call 6104f8 call 6106ae call 5d120a 598 5d5259-5d526a call 5d42d7 587->598 599 5d5245 587->599 605 5d526c-5d5271 598->605 606 5d5273-5d528f call 5d5618 CoInitializeEx 598->606 601 5d524a-5d5254 call 610237 599->601 607 5d54d4-5d54db 601->607 605->601 615 5d5298-5d52a4 call 60fcae 606->615 616 5d5291-5d5296 606->616 609 5d54dd-5d54e3 call 615636 607->609 610 5d54e8-5d54ea 607->610 609->610 613 5d54ec-5d54f3 610->613 614 5d54fa-5d5518 call 5dd82f call 5ea8d6 call 5eab24 610->614 613->614 617 5d54f5 call 5e41ec 613->617 636 5d551a-5d5522 614->636 637 5d5546-5d5559 call 5d4fa4 614->637 624 5d52b8-5d52c7 call 610e07 615->624 625 5d52a6 615->625 616->601 617->614 634 5d52c9-5d52ce 624->634 635 5d52d0-5d52df call 612af7 624->635 628 5d52ab-5d52b3 call 610237 625->628 628->607 634->628 643 5d52e8-5d52f7 call 613565 635->643 644 5d52e1-5d52e6 635->644 636->637 639 5d5524-5d5527 636->639 648 5d555b call 613a35 637->648 649 5d5560-5d5567 637->649 639->637 642 5d5529-5d5544 call 5e434c call 5d5602 639->642 642->637 658 5d52f9-5d52fe 643->658 659 5d5300-5d531f GetVersionExW 643->659 644->628 648->649 653 5d556e-5d5575 649->653 654 5d5569 call 612efe 649->654 655 5d557c-5d5583 653->655 656 5d5577 call 611479 653->656 654->653 662 5d558a-5d558c 655->662 663 5d5585 call 60fdbd 655->663 656->655 658->628 665 5d5359-5d539e call 5d33c7 call 5d5602 659->665 666 5d5321-5d532b GetLastError 659->666 669 5d558e CoUninitialize 662->669 670 5d5594-5d559b 662->670 663->662 689 5d53b1-5d53c1 call 5e752a 665->689 690 5d53a0-5d53ab call 615636 665->690 671 5d532d-5d5336 666->671 672 5d5338 666->672 669->670 676 5d559d-5d559f 670->676 677 5d55d6-5d55df call 610113 670->677 671->672 673 5d533f-5d5354 call 5d3821 672->673 674 5d533a 672->674 673->628 674->673 681 5d55a5-5d55ab 676->681 682 5d55a1-5d55a3 676->682 687 5d55e6-5d55ff call 610802 call 5fe06f 677->687 688 5d55e1 call 5d45ee 677->688 686 5d55ad-5d55c6 call 5e3d85 call 5d5602 681->686 682->686 686->677 705 5d55c8-5d55d5 call 5d5602 686->705 688->687 701 5d53cd-5d53d6 689->701 702 5d53c3 689->702 690->689 706 5d53dc-5d53df 701->706 707 5d549e-5d54b4 call 5d4d39 701->707 702->701 705->677 710 5d53e5-5d53e8 706->710 711 5d5476-5d5489 call 5d4ae5 706->711 718 5d54b6 707->718 719 5d54c0-5d54d2 707->719 714 5d544e-5d546a call 5d48ef 710->714 715 5d53ea-5d53ed 710->715 723 5d548e-5d5492 711->723 714->719 730 5d546c 714->730 721 5d53ef-5d53f2 715->721 722 5d5426-5d5442 call 5d4a88 715->722 718->719 719->607 725 5d53f4-5d53f9 721->725 726 5d5403-5d5416 call 5d4c86 721->726 722->719 732 5d5444 722->732 723->719 727 5d5494 723->727 725->726 726->719 734 5d541c 726->734 727->707 730->711 732->714 734->722
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 005D5217
                                                    • Part of subcall function 006104F8: InitializeCriticalSection.KERNEL32(0063B5FC,?,005D5223,00000000,?,?,?,?,?,?), ref: 0061050F
                                                    • Part of subcall function 005D120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,005D523F,00000000,?), ref: 005D1248
                                                    • Part of subcall function 005D120A: GetLastError.KERNEL32(?,?,?,005D523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005D1252
                                                  • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005D5285
                                                    • Part of subcall function 00610E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00610E28
                                                  • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 005D5317
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 005D5321
                                                  • CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005D558E
                                                  Strings
                                                  • Failed to initialize COM., xrefs: 005D5291
                                                  • user.cpp, xrefs: 005D5345
                                                  • Failed to run untrusted mode., xrefs: 005D54B6
                                                  • Failed to initialize Regutil., xrefs: 005D52C9
                                                  • Failed to run per-machine mode., xrefs: 005D546C
                                                  • 3.11.1.2318, xrefs: 005D5384
                                                  • Failed to run embedded mode., xrefs: 005D5444
                                                  • Failed to get OS info., xrefs: 005D534F
                                                  • Failed to initialize Cryputil., xrefs: 005D52A6
                                                  • Failed to run per-user mode., xrefs: 005D5494
                                                  • Failed to run RunOnce mode., xrefs: 005D541C
                                                  • Failed to initialize Wiutil., xrefs: 005D52E1
                                                  • Failed to initialize XML util., xrefs: 005D52F9
                                                  • Failed to parse command line., xrefs: 005D5245
                                                  • Invalid run mode., xrefs: 005D53F9
                                                  • Failed to initialize user state., xrefs: 005D526C
                                                  • Failed to initialize core., xrefs: 005D53C3
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                  • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$user.cpp
                                                  • API String ID: 3262001429-510904028
                                                  • Opcode ID: 0be1cf84bc4a65fc1c3de6e08b90bcc5f6e36842aa47c9fe5b676901c599f859
                                                  • Instruction ID: cb92bd5759fd645621e9a632ee036dd2b8e6c979580af4d48284b27499732777
                                                  • Opcode Fuzzy Hash: 0be1cf84bc4a65fc1c3de6e08b90bcc5f6e36842aa47c9fe5b676901c599f859
                                                  • Instruction Fuzzy Hash: 2EB1A271D40A299BDB32AF688C46BED7AB6BF44311F050497E908A6341EB709E84DF91
                                                  Function 005E752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 735 5e752a-5e756f call 5ff8e0 call 5d762c 740 5e757b-5e758c call 5dc407 735->740 741 5e7571-5e7576 735->741 746 5e758e-5e7593 740->746 747 5e7598-5e75a9 call 5dc26e 740->747 742 5e7814-5e781b call 610237 741->742 750 5e781c-5e7821 742->750 746->742 757 5e75ab-5e75b0 747->757 758 5e75b5-5e75ca call 5dc4c8 747->758 752 5e7829-5e782d 750->752 753 5e7823-5e7824 call 615636 750->753 755 5e782f-5e7832 call 615636 752->755 756 5e7837-5e783c 752->756 753->752 755->756 760 5e783e-5e783f call 615636 756->760 761 5e7844-5e7851 call 5dc1bb 756->761 757->742 767 5e75cc-5e75d1 758->767 768 5e75d6-5e75e6 call 5fc001 758->768 760->761 769 5e785b-5e785f 761->769 770 5e7853-5e7856 call 615636 761->770 767->742 778 5e75e8-5e75ed 768->778 779 5e75f2-5e7665 call 5e5c33 768->779 774 5e7869-5e786d 769->774 775 5e7861-5e7864 call 615636 769->775 770->769 776 5e786f-5e7872 call 5d3a16 774->776 777 5e7877-5e787f 774->777 775->774 776->777 778->742 784 5e7667-5e766c 779->784 785 5e7671-5e7676 779->785 784->742 786 5e767d-5e76b4 call 5d5602 GetCurrentProcess call 610879 call 5d827b 785->786 787 5e7678 785->787 794 5e76ce-5e76e5 call 5d827b 786->794 795 5e76b6 786->795 787->786 800 5e76ee-5e76f3 794->800 801 5e76e7-5e76ec 794->801 797 5e76bb-5e76c9 call 610237 795->797 797->750 803 5e774f-5e7754 800->803 804 5e76f5-5e7707 call 5d821f 800->804 801->797 805 5e7756-5e7768 call 5d821f 803->805 806 5e7774-5e777d 803->806 814 5e7709-5e770e 804->814 815 5e7713-5e7723 call 5d3436 804->815 805->806 817 5e776a-5e776f 805->817 809 5e777f-5e7782 806->809 810 5e7789-5e779d call 5ea50c 806->810 809->810 813 5e7784-5e7787 809->813 822 5e779f-5e77a4 810->822 823 5e77a6 810->823 813->810 818 5e77ac-5e77af 813->818 814->742 827 5e772f-5e7743 call 5d821f 815->827 828 5e7725-5e772a 815->828 817->742 824 5e77b6-5e77cc call 5dd5a0 818->824 825 5e77b1-5e77b4 818->825 822->742 823->818 831 5e77ce-5e77d3 824->831 832 5e77d5-5e77e4 call 5dcbc5 824->832 825->750 825->824 827->803 835 5e7745-5e774a 827->835 828->742 831->742 836 5e77e9-5e77ed 832->836 835->742 837 5e77ef-5e77f4 836->837 838 5e77f6-5e780d call 5dc8e6 836->838 837->742 838->750 841 5e780f 838->841 841->742
                                                  Strings
                                                  • WixBundleUILevel, xrefs: 005E76D6, 005E76E7
                                                  • WixBundleSourceProcessFolder, xrefs: 005E7734
                                                  • Failed to get manifest stream from container., xrefs: 005E75CC
                                                  • Failed to open manifest stream., xrefs: 005E75AB
                                                  • WixBundleOriginalSource, xrefs: 005E7759
                                                  • Failed to set source process path variable., xrefs: 005E7709
                                                  • Failed to open attached UX container., xrefs: 005E758E
                                                  • Failed to initialize internal cache functionality., xrefs: 005E779F
                                                  • Failed to initialize variables., xrefs: 005E7571
                                                  • Failed to load manifest., xrefs: 005E75E8
                                                  • Failed to extract bootstrapper application payloads., xrefs: 005E77EF
                                                  • Failed to get unique temporary folder for bootstrapper application., xrefs: 005E77CE
                                                  • Failed to get source process folder from path., xrefs: 005E7725
                                                  • WixBundleSourceProcessPath, xrefs: 005E76F8
                                                  • Failed to set source process folder variable., xrefs: 005E7745
                                                  • Failed to set original source variable., xrefs: 005E776A
                                                  • Failed to parse command line., xrefs: 005E7667
                                                  • Failed to load catalog files., xrefs: 005E780F
                                                  • WixBundleElevated, xrefs: 005E76A5, 005E76B6
                                                  • Failed to overwrite the %ls built-in variable., xrefs: 005E76BB
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalInitializeSection
                                                  • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                  • API String ID: 32694325-1564579409
                                                  • Opcode ID: 84213467b5cd70a9ff73fefa51633786a305bb41a0d9733f0f25f62f92473b27
                                                  • Instruction ID: d470ea10dc2c03e2510d669c03652cddbbda772dfa599963fe3d07c1155e7d41
                                                  • Opcode Fuzzy Hash: 84213467b5cd70a9ff73fefa51633786a305bb41a0d9733f0f25f62f92473b27
                                                  • Instruction Fuzzy Hash: C9A1D972E48A6EBBDB169AA5CC45EEEBB6DBF08700F010566F555E7140DB30E940CBE0
                                                  Function 005D762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 842 5d762c-5d7edf InitializeCriticalSection 843 5d7ee2-5d7f06 call 5d5623 842->843 846 5d7f08-5d7f0f 843->846 847 5d7f13-5d7f24 call 610237 843->847 846->843 848 5d7f11 846->848 850 5d7f27-5d7f39 call 5fe06f 847->850 848->850
                                                  APIs
                                                  • InitializeCriticalSection.KERNEL32(005E756B,005D53BD,00000000,005D5445), ref: 005D764C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalInitializeSection
                                                  • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                  • API String ID: 32694325-3635313340
                                                  • Opcode ID: 2120f639c56bfbd86c2ac3e4422893152d00d340cc71c5e74852b1c67040d46a
                                                  • Instruction ID: 0ec3f60a4fc1da74370cd70bbc8b6f804cf3ff3534020a13b11d458e3e0a2e20
                                                  • Opcode Fuzzy Hash: 2120f639c56bfbd86c2ac3e4422893152d00d340cc71c5e74852b1c67040d46a
                                                  • Instruction Fuzzy Hash: 633247B0C516299BDB65CF5AC8887DDFEF5BB48314F9485EED20CAA210D7B00AC98F45
                                                  Function 005E82BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 854 5e82ba-5e8303 call 5ff8e0 857 5e847c-5e8489 call 5d2195 854->857 858 5e8309-5e8317 GetCurrentProcess call 610879 854->858 863 5e848b 857->863 864 5e8498-5e84aa call 5fe06f 857->864 862 5e831c-5e8329 858->862 865 5e832f-5e833e GetWindowsDirectoryW 862->865 866 5e83b7-5e83c5 862->866 867 5e8490-5e8497 call 610237 863->867 869 5e8378-5e8389 call 5d337f 865->869 870 5e8340-5e834a GetLastError 865->870 879 5e83ff-5e8411 UuidCreate 866->879 880 5e83c7-5e83d1 GetLastError 866->880 867->864 883 5e838b-5e8390 869->883 884 5e8395-5e83ab call 5d36a3 869->884 874 5e834c-5e8355 870->874 875 5e8357 870->875 874->875 881 5e835e-5e8373 call 5d3821 875->881 882 5e8359 875->882 885 5e841a-5e842f StringFromGUID2 879->885 886 5e8413-5e8418 879->886 887 5e83de 880->887 888 5e83d3-5e83dc 880->888 881->867 882->881 883->867 884->879 901 5e83ad-5e83b2 884->901 892 5e844d-5e846e call 5d1f13 885->892 893 5e8431-5e844b call 5d3821 885->893 886->867 894 5e83e5-5e83fa call 5d3821 887->894 895 5e83e0 887->895 888->887 904 5e8477 892->904 905 5e8470-5e8475 892->905 893->867 894->867 895->894 901->867 904->857 905->867
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,005D5489), ref: 005E8310
                                                    • Part of subcall function 00610879: OpenProcessToken.ADVAPI32(?,00000008,?,005D53BD,00000000,?,?,?,?,?,?,?,005E769D,00000000), ref: 00610897
                                                    • Part of subcall function 00610879: GetLastError.KERNEL32(?,?,?,?,?,?,?,005E769D,00000000), ref: 006108A1
                                                    • Part of subcall function 00610879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,005E769D,00000000), ref: 0061092B
                                                  • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 005E8336
                                                  • GetLastError.KERNEL32 ref: 005E8340
                                                  • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 005E83BD
                                                  • GetLastError.KERNEL32 ref: 005E83C7
                                                  • UuidCreate.RPCRT4(?), ref: 005E8406
                                                  Strings
                                                  • Failed to get windows path for working folder., xrefs: 005E836E
                                                  • 4#v, xrefs: 005E83BD
                                                  • Failed to create working folder guid., xrefs: 005E8413
                                                  • Failed to copy working folder path., xrefs: 005E848B
                                                  • Failed to append bundle id on to temp path for working folder., xrefs: 005E8470
                                                  • Failed to concat Temp directory on windows path for working folder., xrefs: 005E83AD
                                                  • Failed to get temp path for working folder., xrefs: 005E83F5
                                                  • %ls%ls\, xrefs: 005E8458
                                                  • cache.cpp, xrefs: 005E8364, 005E83EB, 005E843C
                                                  • Failed to ensure windows path for working folder ended in backslash., xrefs: 005E838B
                                                  • Temp\, xrefs: 005E8395
                                                  • Failed to convert working folder guid into string., xrefs: 005E8446
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                  • String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                  • API String ID: 266130487-3587817078
                                                  • Opcode ID: 929679994a1ded5a53d45591a580fd0cf4368da51a98d69e950c569dc25e513b
                                                  • Instruction ID: 7e8fe576aea0ccb712a249c3bbc42a83209453ee204baa55ffe311d3661ac482
                                                  • Opcode Fuzzy Hash: 929679994a1ded5a53d45591a580fd0cf4368da51a98d69e950c569dc25e513b
                                                  • Instruction Fuzzy Hash: 15413C33A41776B7DB3096E5DC09FBA7B69BB04B10F024556BE88F7180DA749D008BD5
                                                  Function 005F10FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 906 5f10fb-5f1127 CoInitializeEx 907 5f113b-5f1186 call 60f483 906->907 908 5f1129-5f1136 call 610237 906->908 914 5f1188-5f11ab call 5d3821 call 610237 907->914 915 5f11b0-5f11d2 call 60f4a4 907->915 913 5f139e-5f13b0 call 5fe06f 908->913 936 5f1397-5f1398 CoUninitialize 914->936 922 5f128c-5f1297 SetEvent 915->922 923 5f11d8-5f11e0 915->923 927 5f1299-5f12a3 GetLastError 922->927 928 5f12d6-5f12e4 WaitForSingleObject 922->928 925 5f138f-5f1392 call 60f4b4 923->925 926 5f11e6-5f11ec 923->926 925->936 926->925 930 5f11f2-5f11fa 926->930 933 5f12a5-5f12ae 927->933 934 5f12b0 927->934 931 5f1318-5f1323 ResetEvent 928->931 932 5f12e6-5f12f0 GetLastError 928->932 937 5f11fc-5f11fe 930->937 938 5f1274-5f1287 call 610237 930->938 941 5f135a-5f1360 931->941 942 5f1325-5f132f GetLastError 931->942 939 5f12fd 932->939 940 5f12f2-5f12fb 932->940 933->934 943 5f12b4-5f12c4 call 5d3821 934->943 944 5f12b2 934->944 936->913 946 5f1211-5f1214 937->946 947 5f1200 937->947 938->925 951 5f12ff 939->951 952 5f1301-5f1316 call 5d3821 939->952 940->939 948 5f138a 941->948 949 5f1362-5f1365 941->949 953 5f133c 942->953 954 5f1331-5f133a 942->954 966 5f12c9-5f12d1 call 610237 943->966 944->943 962 5f126e 946->962 963 5f1216 946->963 958 5f1206-5f120f 947->958 959 5f1202-5f1204 947->959 948->925 960 5f1367-5f1381 call 5d3821 949->960 961 5f1386-5f1388 949->961 951->952 952->966 956 5f133e 953->956 957 5f1340-5f1355 call 5d3821 953->957 954->953 956->957 957->966 968 5f1270-5f1272 958->968 959->968 960->966 961->925 962->968 970 5f124e-5f1253 963->970 971 5f121d-5f1222 963->971 972 5f125c-5f1261 963->972 973 5f122b-5f1230 963->973 974 5f126a-5f126c 963->974 975 5f1239-5f123e 963->975 976 5f1247-5f124c 963->976 977 5f1255-5f125a 963->977 978 5f1224-5f1229 963->978 979 5f1263-5f1268 963->979 980 5f1232-5f1237 963->980 981 5f1240-5f1245 963->981 966->925 968->922 968->938 970->938 971->938 972->938 973->938 974->938 975->938 976->938 977->938 978->938 979->938 980->938 981->938
                                                  APIs
                                                  • CoInitializeEx.OLE32(00000000,00000000), ref: 005F111D
                                                  • CoUninitialize.COMBASE ref: 005F1398
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: InitializeUninitialize
                                                  • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 3442037557-1168358783
                                                  • Opcode ID: 472d989afc0c18fd7a309d665bf2cce628a5585e4ba671ab8bc104fae31575a1
                                                  • Instruction ID: 1bb12a128ce230b04825c65c546169d1be32455bd7d883838dacb1c449f39971
                                                  • Opcode Fuzzy Hash: 472d989afc0c18fd7a309d665bf2cce628a5585e4ba671ab8bc104fae31575a1
                                                  • Instruction Fuzzy Hash: 1651683BD40979D78B2097D68C059BB2E56BB44770B260B26AF01FB2D1D66C8C00D5DE
                                                  Function 005D42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 987 5d42d7-5d432e InitializeCriticalSection * 2 call 5e4d05 * 2 992 5d4334 987->992 993 5d4452-5d445c call 5db48b 987->993 994 5d433a-5d4347 992->994 998 5d4461-5d4465 993->998 996 5d434d-5d4379 lstrlenW * 2 CompareStringW 994->996 997 5d4445-5d444c 994->997 999 5d43cb-5d43f7 lstrlenW * 2 CompareStringW 996->999 1000 5d437b-5d439e lstrlenW 996->1000 997->993 997->994 1001 5d4474-5d447c 998->1001 1002 5d4467-5d4473 call 610237 998->1002 999->997 1006 5d43f9-5d441c lstrlenW 999->1006 1003 5d448a-5d449f call 5d3821 1000->1003 1004 5d43a4-5d43a9 1000->1004 1002->1001 1018 5d44a4-5d44ab 1003->1018 1004->1003 1007 5d43af-5d43bf call 5d29ce 1004->1007 1010 5d44b6-5d44d0 call 5d3821 1006->1010 1011 5d4422-5d4427 1006->1011 1021 5d447f-5d4488 1007->1021 1022 5d43c5 1007->1022 1010->1018 1011->1010 1015 5d442d-5d443d call 5d29ce 1011->1015 1015->1021 1025 5d443f 1015->1025 1023 5d44ac-5d44b4 call 610237 1018->1023 1021->1023 1022->999 1023->1001 1025->997
                                                  APIs
                                                  • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,005D5266,?,?,00000000,?,?), ref: 005D4303
                                                  • InitializeCriticalSection.KERNEL32(000000D0,?,?,005D5266,?,?,00000000,?,?), ref: 005D430C
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,005D5266,?,?,00000000,?,?), ref: 005D4352
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,005D5266,?,?,00000000,?,?), ref: 005D435C
                                                  • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005D5266,?,?,00000000,?,?), ref: 005D4370
                                                  • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,005D5266,?,?,00000000,?,?), ref: 005D4380
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,?,?,005D5266,?,?,00000000,?,?), ref: 005D43D0
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,005D5266,?,?,00000000,?,?), ref: 005D43DA
                                                  • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005D5266,?,?,00000000,?,?), ref: 005D43EE
                                                  • lstrlenW.KERNEL32(burn.filehandle.self,?,?,005D5266,?,?,00000000,?,?), ref: 005D43FE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                  • String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                  • API String ID: 3039292287-3209860532
                                                  • Opcode ID: af2bfa3a32f43db7ae2e627ad26f639afc29c216016a491fbab906af0ef7a6c1
                                                  • Instruction ID: d6056ab84a53a4ed315fc679029f5aeb3475e71eec98e0af25d15460af62b03f
                                                  • Opcode Fuzzy Hash: af2bfa3a32f43db7ae2e627ad26f639afc29c216016a491fbab906af0ef7a6c1
                                                  • Instruction Fuzzy Hash: 7D518371A40215BFCB24DF6CCC46F9A7B6AFF04760F154117F615E7290DBB0A990CAA4
                                                  Function 005EE7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1027 5ee7b4-5ee7f1 1028 5ee813-5ee834 RegisterClassW 1027->1028 1029 5ee7f3-5ee807 TlsSetValue 1027->1029 1031 5ee86e-5ee8a5 CreateWindowExW 1028->1031 1032 5ee836-5ee840 GetLastError 1028->1032 1029->1028 1030 5ee809-5ee80e 1029->1030 1033 5ee93d-5ee953 UnregisterClassW 1030->1033 1036 5ee8dc-5ee8f0 SetEvent 1031->1036 1037 5ee8a7-5ee8b1 GetLastError 1031->1037 1034 5ee84d 1032->1034 1035 5ee842-5ee84b 1032->1035 1039 5ee84f 1034->1039 1040 5ee854-5ee869 call 5d3821 1034->1040 1035->1034 1038 5ee91c-5ee927 KiUserCallbackDispatcher 1036->1038 1041 5ee8be 1037->1041 1042 5ee8b3-5ee8bc 1037->1042 1045 5ee929 1038->1045 1046 5ee8f2-5ee8f5 1038->1046 1039->1040 1054 5ee935-5ee93c call 610237 1040->1054 1043 5ee8c5-5ee8da call 5d3821 1041->1043 1044 5ee8c0 1041->1044 1042->1041 1043->1054 1044->1043 1045->1033 1049 5ee92b-5ee930 1046->1049 1050 5ee8f7-5ee906 IsDialogMessageW 1046->1050 1049->1054 1050->1038 1053 5ee908-5ee916 TranslateMessage DispatchMessageW 1050->1053 1053->1038 1054->1033
                                                  APIs
                                                  • TlsSetValue.KERNEL32(?,?), ref: 005EE7FF
                                                  • RegisterClassW.USER32(?), ref: 005EE82B
                                                  • GetLastError.KERNEL32 ref: 005EE836
                                                  • CreateWindowExW.USER32(00000080,00629E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 005EE89D
                                                  • GetLastError.KERNEL32 ref: 005EE8A7
                                                  • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 005EE945
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                  • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                  • API String ID: 213125376-288575659
                                                  • Opcode ID: 64c2f48c26bac8f249e207ac7cf62118d73e0959e18505e3f0ba086dbeb0224f
                                                  • Instruction ID: f51fe9d9e5023926152a151638b5dee185c12ba7a0e53fb494d7a03c64511453
                                                  • Opcode Fuzzy Hash: 64c2f48c26bac8f249e207ac7cf62118d73e0959e18505e3f0ba086dbeb0224f
                                                  • Instruction Fuzzy Hash: F441D572900225EBDB248BA6DC45ADEBFB9FF08710F158126F954FB150D7309D40DBA0
                                                  Function 005DC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1057 5dc28f-5dc2c1 1058 5dc32b-5dc347 GetCurrentProcess * 2 DuplicateHandle 1057->1058 1059 5dc2c3-5dc2e1 CreateFileW 1057->1059 1062 5dc349-5dc353 GetLastError 1058->1062 1063 5dc381 1058->1063 1060 5dc2e7-5dc2f1 GetLastError 1059->1060 1061 5dc383-5dc389 1059->1061 1064 5dc2fe 1060->1064 1065 5dc2f3-5dc2fc 1060->1065 1066 5dc38b-5dc391 1061->1066 1067 5dc393 1061->1067 1068 5dc355-5dc35e 1062->1068 1069 5dc360 1062->1069 1063->1061 1070 5dc305-5dc318 call 5d3821 1064->1070 1071 5dc300 1064->1071 1065->1064 1072 5dc395-5dc3a3 SetFilePointerEx 1066->1072 1067->1072 1068->1069 1073 5dc367-5dc37f call 5d3821 1069->1073 1074 5dc362 1069->1074 1086 5dc31d-5dc326 call 610237 1070->1086 1071->1070 1077 5dc3da-5dc3e0 1072->1077 1078 5dc3a5-5dc3af GetLastError 1072->1078 1073->1086 1074->1073 1083 5dc3fe-5dc404 1077->1083 1084 5dc3e2-5dc3e6 call 5f1741 1077->1084 1081 5dc3bc 1078->1081 1082 5dc3b1-5dc3ba 1078->1082 1087 5dc3be 1081->1087 1088 5dc3c3-5dc3d8 call 5d3821 1081->1088 1082->1081 1089 5dc3eb-5dc3ef 1084->1089 1086->1083 1087->1088 1095 5dc3f6-5dc3fd call 610237 1088->1095 1089->1083 1092 5dc3f1 1089->1092 1092->1095 1095->1083
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,005DC47F,005D5405,?,?,005D5445), ref: 005DC2D6
                                                  • GetLastError.KERNEL32(?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC2E7
                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?), ref: 005DC336
                                                  • GetCurrentProcess.KERNEL32(000000FF,00000000,?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC33C
                                                  • DuplicateHandle.KERNELBASE(00000000,?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC33F
                                                  • GetLastError.KERNEL32(?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC349
                                                  • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC39B
                                                  • GetLastError.KERNEL32(?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005DC3A5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                  • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                  • API String ID: 2619879409-373955632
                                                  • Opcode ID: 7b12629c11b570ef403673d7b526258ccec66bc216cecc16a98ecb6438badfe2
                                                  • Instruction ID: 05306b314cea25673e588f239cc4c75307ee6e8ee3104c32909ec0837f34bdbf
                                                  • Opcode Fuzzy Hash: 7b12629c11b570ef403673d7b526258ccec66bc216cecc16a98ecb6438badfe2
                                                  • Instruction Fuzzy Hash: 4441B636140202ABDB309F6D8D49E5B7FA6FBC4721B26882BF914DB341DB71C801DB60
                                                  Function 00612AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1098 612af7-612b17 call 5d3838 1101 612c21-612c25 1098->1101 1102 612b1d-612b2b call 614a6c 1098->1102 1104 612c27-612c2a call 615636 1101->1104 1105 612c2f-612c35 1101->1105 1106 612b30-612b4f GetProcAddress 1102->1106 1104->1105 1108 612b51 1106->1108 1109 612b56-612b6f GetProcAddress 1106->1109 1108->1109 1110 612b71 1109->1110 1111 612b76-612b8f GetProcAddress 1109->1111 1110->1111 1112 612b91 1111->1112 1113 612b96-612baf GetProcAddress 1111->1113 1112->1113 1114 612bb1 1113->1114 1115 612bb6-612bcf GetProcAddress 1113->1115 1114->1115 1116 612bd1 1115->1116 1117 612bd6-612bef GetProcAddress 1115->1117 1116->1117 1118 612bf1 1117->1118 1119 612bf6-612c10 GetProcAddress 1117->1119 1118->1119 1120 612c12 1119->1120 1121 612c17 1119->1121 1120->1121 1121->1101
                                                  APIs
                                                    • Part of subcall function 005D3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005D3877
                                                    • Part of subcall function 005D3838: GetLastError.KERNEL32 ref: 005D3881
                                                    • Part of subcall function 00614A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00614A9D
                                                  • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00612B41
                                                  • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00612B61
                                                  • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00612B81
                                                  • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00612BA1
                                                  • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00612BC1
                                                  • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00612BE1
                                                  • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00612C01
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$ErrorLast$DirectorySystem
                                                  • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                  • API String ID: 2510051996-1735120554
                                                  • Opcode ID: 2352a5470cd02c059898171e9bdef87a39cbf80f1a87d6cc61c965da11a70fa0
                                                  • Instruction ID: 907caef180ffe00b275783e779e1a6693d9537e6303e1dcb940da30f3457b305
                                                  • Opcode Fuzzy Hash: 2352a5470cd02c059898171e9bdef87a39cbf80f1a87d6cc61c965da11a70fa0
                                                  • Instruction Fuzzy Hash: 713114B0900A09EFDB119F20ED13BA97BA3F753348F05712AE60496272E7B14891EFD4
                                                  Function 0061304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1122 61304f-613073 GetModuleHandleA 1123 613075-61307f GetLastError 1122->1123 1124 6130a8-6130b9 GetProcAddress 1122->1124 1125 613081-61308a 1123->1125 1126 61308c 1123->1126 1127 6130bb-6130df GetProcAddress * 3 1124->1127 1128 6130fc 1124->1128 1125->1126 1130 613093-6130a3 call 5d3821 1126->1130 1131 61308e 1126->1131 1132 6130e1-6130e3 1127->1132 1133 6130f8-6130fa 1127->1133 1129 6130fe-61311b CoCreateInstance 1128->1129 1134 6131b1-6131b3 1129->1134 1135 613121-613123 1129->1135 1145 6131c7-6131cc 1130->1145 1131->1130 1132->1133 1137 6130e5-6130e7 1132->1137 1133->1129 1139 6131b5-6131bc 1134->1139 1140 6131c6 1134->1140 1138 613128-613138 1135->1138 1137->1133 1142 6130e9-6130f6 1137->1142 1143 613142 1138->1143 1144 61313a-61313e 1138->1144 1139->1140 1155 6131be-6131c0 ExitProcess 1139->1155 1140->1145 1142->1129 1149 613144-613154 1143->1149 1144->1138 1147 613140 1144->1147 1150 6131d4-6131d9 1145->1150 1151 6131ce-6131d0 1145->1151 1154 61315c 1147->1154 1156 613166-61316a 1149->1156 1157 613156-61315a 1149->1157 1152 6131e1-6131e8 1150->1152 1153 6131db-6131dd 1150->1153 1151->1150 1153->1152 1154->1156 1159 613195-6131a6 1156->1159 1160 61316c-61317f call 6131eb 1156->1160 1157->1149 1157->1154 1159->1134 1162 6131a8-6131af 1159->1162 1160->1134 1164 613181-613193 1160->1164 1162->1134 1164->1134 1164->1159
                                                  APIs
                                                  • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00613609,00000000,?,00000000), ref: 00613069
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,005FC025,?,005D5405,?,00000000,?), ref: 00613075
                                                  • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 006130B5
                                                  • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006130C1
                                                  • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 006130CC
                                                  • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006130D6
                                                  • CoCreateInstance.OLE32(0063B6B8,00000000,00000001,0061B818,?,?,?,?,?,?,?,?,?,?,?,005FC025), ref: 00613111
                                                  • ExitProcess.KERNEL32 ref: 006131C0
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                  • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                  • API String ID: 2124981135-499589564
                                                  • Opcode ID: b4be2b4b664a7d9c110e195c85520481fce03c5f4630c10c4d035c1855bafbf6
                                                  • Instruction ID: 8d7a355a34777e110d0f7569293b889bb086bb2b6dd4de5f443fbe1b1afc2e0e
                                                  • Opcode Fuzzy Hash: b4be2b4b664a7d9c110e195c85520481fce03c5f4630c10c4d035c1855bafbf6
                                                  • Instruction Fuzzy Hash: 78418631A01225BBDB24DFA9C846BEEBBB6EF45711F194169E902E7340D771DF808790
                                                  Function 005F1741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1166 5f1741-5f1761 call 5d2195 1169 5f176d-5f177f CreateEventW 1166->1169 1170 5f1763-5f1768 1166->1170 1172 5f17b9-5f17c5 CreateEventW 1169->1172 1173 5f1781-5f178b GetLastError 1169->1173 1171 5f1859-5f1860 call 610237 1170->1171 1186 5f1861-5f1867 1171->1186 1176 5f17fc-5f1811 CreateThread 1172->1176 1177 5f17c7-5f17d1 GetLastError 1172->1177 1174 5f178d-5f1796 1173->1174 1175 5f1798 1173->1175 1174->1175 1181 5f179f-5f17b4 call 5d3821 1175->1181 1182 5f179a 1175->1182 1179 5f1848-5f1852 call 5f14e1 1176->1179 1180 5f1813-5f181d GetLastError 1176->1180 1183 5f17de 1177->1183 1184 5f17d3-5f17dc 1177->1184 1179->1186 1200 5f1854 1179->1200 1187 5f181f-5f1828 1180->1187 1188 5f182a 1180->1188 1181->1171 1182->1181 1191 5f17e5-5f17fa call 5d3821 1183->1191 1192 5f17e0 1183->1192 1184->1183 1187->1188 1193 5f182c 1188->1193 1194 5f1831-5f1846 call 5d3821 1188->1194 1191->1171 1192->1191 1193->1194 1194->1171 1200->1171
                                                  APIs
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,005DC3EB,?,00000000,?,005DC47F), ref: 005F1778
                                                  • GetLastError.KERNEL32(?,005DC3EB,?,00000000,?,005DC47F,005D5405,?,?,005D5445,005D5445,00000000,?,00000000), ref: 005F1781
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorEventLast
                                                  • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                  • API String ID: 545576003-938279966
                                                  • Opcode ID: f5082a96f965770f4f221ddc58f2688539a3c68d35a82e21acf84b4ddee5bf94
                                                  • Instruction ID: 9fe46d7ccb84b6a3cba6b836890826a789842819d8a7ddc968ff234495715ba4
                                                  • Opcode Fuzzy Hash: f5082a96f965770f4f221ddc58f2688539a3c68d35a82e21acf84b4ddee5bf94
                                                  • Instruction Fuzzy Hash: 6E21F877D41E3AB7D32116955D45E776E5DFB047B0B034226BF04BB281E758DC0085E9
                                                  Function 0060FCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0060FCD6
                                                  • GetProcAddress.KERNEL32(SystemFunction041), ref: 0060FCE8
                                                  • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0060FD2B
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0060FD3F
                                                  • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0060FD77
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0060FD8B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$ErrorLast
                                                  • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                  • API String ID: 4214558900-3191127217
                                                  • Opcode ID: 23563b52a96b34a1791fa2e3f717976e3767542ed1418493905fd05a29412405
                                                  • Instruction ID: c66c907debe401ea0743076084fd90fa355a5d39dd1609da39190de6e4b3e1a0
                                                  • Opcode Fuzzy Hash: 23563b52a96b34a1791fa2e3f717976e3767542ed1418493905fd05a29412405
                                                  • Instruction Fuzzy Hash: 5B2150369C1222ABD7355F56AD0979B7A93AF40B61F167136FE00AB6E0E7608C009AD0
                                                  Function 005F08C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 005F08F2
                                                  • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 005F090A
                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 005F090F
                                                  • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 005F0912
                                                  • GetLastError.KERNEL32(?,?), ref: 005F091C
                                                  • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 005F098B
                                                  • GetLastError.KERNEL32(?,?), ref: 005F0998
                                                  Strings
                                                  • Failed to open cabinet file: %hs, xrefs: 005F09C9
                                                  • Failed to add virtual file pointer for cab container., xrefs: 005F0971
                                                  • Failed to duplicate handle to cab container., xrefs: 005F094A
                                                  • cabextract.cpp, xrefs: 005F0940, 005F09BC
                                                  • <the>.cab, xrefs: 005F08EB
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                  • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                  • API String ID: 3030546534-3446344238
                                                  • Opcode ID: b6ae501bdc91ee7739105d0587c277393adfdebed191d21708336222cd85b7c5
                                                  • Instruction ID: 14ab9a6efef0ade3afc7b886a566985ccb31e6bebb155aba490f5720fdc7ddb9
                                                  • Opcode Fuzzy Hash: b6ae501bdc91ee7739105d0587c277393adfdebed191d21708336222cd85b7c5
                                                  • Instruction Fuzzy Hash: 1E315832D41539BBEB205B958D09EAE7E69FF08760F065112FE04B7282E3B49D00DAE1
                                                  Function 005E3F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 005E3AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,005E3FB5,feclient.dll,?,00000000,?,?,?,005D4B12), ref: 005E3B42
                                                  • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,005D4B12,?,?,0061B488,?,00000001,00000000,00000000), ref: 005E404C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseSleep
                                                  • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                  • API String ID: 2834455192-2673269691
                                                  • Opcode ID: 598686a1a4e0484bee01e7215425737dfcf087d46ea839e453949e904f630a10
                                                  • Instruction ID: 81033108405965d583b85e3c067a04229def87e18e2b712ecfb8f5b8bd522119
                                                  • Opcode Fuzzy Hash: 598686a1a4e0484bee01e7215425737dfcf087d46ea839e453949e904f630a10
                                                  • Instruction Fuzzy Hash: B561F271A006A6ABDF2D9F66CC4AB6A7FA9FF10340B054565F940DB240E770ED90DB90
                                                  Function 005D6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00000001,?,00000000,005D5445,00000006,?,005D82B9,?,?,?,00000000,00000000,00000001), ref: 005D6DC8
                                                    • Part of subcall function 005D56A9: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,005D6595,005D6595,?,005D563D,?,?,00000000), ref: 005D56E5
                                                    • Part of subcall function 005D56A9: GetLastError.KERNEL32(?,005D563D,?,?,00000000,?,?,005D6595,?,005D7F02,?,?,?,?,?), ref: 005D5714
                                                  • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,005D82B9), ref: 005D6F59
                                                  Strings
                                                  • Setting string variable '%ls' to value '%ls', xrefs: 005D6EED
                                                  • Failed to set value of variable: %ls, xrefs: 005D6F41
                                                  • Failed to insert variable '%ls'., xrefs: 005D6E0D
                                                  • Setting numeric variable '%ls' to value %lld, xrefs: 005D6EFA
                                                  • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 005D6F6B
                                                  • variable.cpp, xrefs: 005D6E4B
                                                  • Attempt to set built-in variable value: %ls, xrefs: 005D6E56
                                                  • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 005D6ED0
                                                  • Failed to find variable value '%ls'., xrefs: 005D6DE3
                                                  • Unsetting variable '%ls', xrefs: 005D6F15
                                                  • Setting hidden variable '%ls', xrefs: 005D6E86
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                  • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                  • API String ID: 2716280545-445000439
                                                  • Opcode ID: cc652d02edca2c21c6ec11a12ebb2906622e84c84467c6c5167fc3713776cbe4
                                                  • Instruction ID: 1697d47ddc1d929a3a759c7f88e60fffea3027f701f7c1df469b2c641101ff46
                                                  • Opcode Fuzzy Hash: cc652d02edca2c21c6ec11a12ebb2906622e84c84467c6c5167fc3713776cbe4
                                                  • Instruction Fuzzy Hash: D151F771A40226A7DB309F1DDC4AFAB3FA9FB56710F15051BF84496382C275DD82CAE1
                                                  Function 005D4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • IsWindow.USER32(?), ref: 005D4C64
                                                  • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005D4C75
                                                  Strings
                                                  • Failed to check global conditions, xrefs: 005D4B49
                                                  • Failed to set action variables., xrefs: 005D4BC4
                                                  • Failed to query registration., xrefs: 005D4BAE
                                                  • Failed while running , xrefs: 005D4C2A
                                                  • Failed to set layout directory variable to value provided from command-line., xrefs: 005D4C06
                                                  • Failed to open log., xrefs: 005D4B18
                                                  • Failed to set registration variables., xrefs: 005D4BDE
                                                  • Failed to create the message window., xrefs: 005D4B98
                                                  • WixBundleLayoutDirectory, xrefs: 005D4BF5
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: MessagePostWindow
                                                  • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                  • API String ID: 3618638489-3051724725
                                                  • Opcode ID: 96b86f1fb3f36e133a3b74dcb9513b7c112c503c04ebcb60abad7cf604ac3989
                                                  • Instruction ID: f90cef63f91d8e5cc604f4fd0e2cc4d8cb10135140788ab0559a1eed9afcbaf3
                                                  • Opcode Fuzzy Hash: 96b86f1fb3f36e133a3b74dcb9513b7c112c503c04ebcb60abad7cf604ac3989
                                                  • Instruction Fuzzy Hash: A141D631A0161BBBDB3A5A68CC89FBABE6DFF04750F054617B80496260E770ED509ED0
                                                  Function 005D2DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 005D2E5F
                                                  • GetLastError.KERNEL32 ref: 005D2E69
                                                  • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 005D2F09
                                                  • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 005D2F96
                                                  • GetLastError.KERNEL32 ref: 005D2FA3
                                                  • Sleep.KERNEL32(00000064), ref: 005D2FB7
                                                  • CloseHandle.KERNEL32(?), ref: 005D301F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                  • String ID: 4#v$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                  • API String ID: 3480017824-1777530710
                                                  • Opcode ID: c648dac5cafb638284c47c7f73fea4d6825106262a7686813ea0a047379df039
                                                  • Instruction ID: 87dc2ea28a644863f9e355895b2f666a7977b021530fd5681c8b17c18bb842b3
                                                  • Opcode Fuzzy Hash: c648dac5cafb638284c47c7f73fea4d6825106262a7686813ea0a047379df039
                                                  • Instruction Fuzzy Hash: E1716372901129ABDB309FA8DC4DBEABBB9BB18710F054197F904E7290D7349E809F91
                                                  Function 005EEA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,005D548E,?,?), ref: 005EEA9D
                                                  • GetLastError.KERNEL32(?,005D548E,?,?), ref: 005EEAAA
                                                  • CreateThread.KERNELBASE(00000000,00000000,Function_0001E7B4,?,00000000,00000000), ref: 005EEB03
                                                  • GetLastError.KERNEL32(?,005D548E,?,?), ref: 005EEB10
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,005D548E,?,?), ref: 005EEB4B
                                                  • CloseHandle.KERNEL32(00000000,?,005D548E,?,?), ref: 005EEB6A
                                                  • CloseHandle.KERNELBASE(?,?,005D548E,?,?), ref: 005EEB77
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                  • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                  • API String ID: 2351989216-3599963359
                                                  • Opcode ID: 8c3ffd250419fd422774c96647b86b014dcc283ab38899d3d2a9d46960b22df1
                                                  • Instruction ID: d5e94956c7bb1fd79f3e920ff57036a45b302ff8dbad517b87796a2ff5060f0e
                                                  • Opcode Fuzzy Hash: 8c3ffd250419fd422774c96647b86b014dcc283ab38899d3d2a9d46960b22df1
                                                  • Instruction Fuzzy Hash: 3431A876D01129BBD710DF9A9D86A9FBEBDFF08350F15456AF944F7240E7309E008AA1
                                                  Function 005F14E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,76232F60,?,?,005D5405,005D53BD,00000000,005D5445), ref: 005F1506
                                                  • GetLastError.KERNEL32 ref: 005F1519
                                                  • GetExitCodeThread.KERNELBASE(0061B488,?), ref: 005F155B
                                                  • GetLastError.KERNEL32 ref: 005F1569
                                                  • ResetEvent.KERNEL32(0061B460), ref: 005F15A4
                                                  • GetLastError.KERNEL32 ref: 005F15AE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                  • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                  • API String ID: 2979751695-3400260300
                                                  • Opcode ID: 6c60640dd76c7a930191559921000accc4f5554b1b5ccb08763372e60918b269
                                                  • Instruction ID: d6be1caa656bc6ef1a55d2cf7f567f674b18183eb23daebe1afc34ca71356790
                                                  • Opcode Fuzzy Hash: 6c60640dd76c7a930191559921000accc4f5554b1b5ccb08763372e60918b269
                                                  • Instruction Fuzzy Hash: 5331D670A00A0AEBDB109FA99D05ABE7FF9FB44300B10801BFA02DA160E774CA009F59
                                                  Function 005DCBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,005D53BD,00000000,005D5489,005D5445,WixBundleUILevel,840F01E8,?,00000001), ref: 005DCC1C
                                                  Strings
                                                  • Failed to extract file., xrefs: 005DCCE7
                                                  • Payload was not found in container: %ls, xrefs: 005DCD29
                                                  • Failed to get directory portion of local file path, xrefs: 005DCCF5
                                                  • Failed to concat file paths., xrefs: 005DCCFC
                                                  • Failed to find embedded payload: %ls, xrefs: 005DCC48
                                                  • Failed to ensure directory exists, xrefs: 005DCCEE
                                                  • payload.cpp, xrefs: 005DCD1D
                                                  • Failed to get next stream., xrefs: 005DCD03
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                  • API String ID: 1825529933-1711239286
                                                  • Opcode ID: b44bd6919b24d2d0b6fd2751c9304d4abbf3e6f4a64f17d0b14fb7886511ee40
                                                  • Instruction ID: 159789b31d95bdfbce94cda2200767754e5b8549b00f647eb1a8d04d2257a70f
                                                  • Opcode Fuzzy Hash: b44bd6919b24d2d0b6fd2751c9304d4abbf3e6f4a64f17d0b14fb7886511ee40
                                                  • Instruction Fuzzy Hash: B641C231941216EBCF35EF4CCC859AEBF66BF40710B15816BE919AB361D7709D80EB90
                                                  Function 005D4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 005D47BB
                                                  • GetCurrentThreadId.KERNEL32 ref: 005D47C1
                                                  • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005D484F
                                                  Strings
                                                  • Failed to create user for UX., xrefs: 005D47DB
                                                  • user.cpp, xrefs: 005D489B
                                                  • wininet.dll, xrefs: 005D47EE
                                                  • Failed to load UX., xrefs: 005D4804
                                                  • Unexpected return value from message pump., xrefs: 005D48A5
                                                  • Failed to start bootstrapper application., xrefs: 005D481D
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Message$CurrentPeekThread
                                                  • String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$user.cpp$wininet.dll
                                                  • API String ID: 673430819-2573580774
                                                  • Opcode ID: 6e3033d9ccef0e7e185a48753421e4d47c07fcdd5867c65b2f6808fb8f3ea5e3
                                                  • Instruction ID: c2e0897574ff176aefe4afab4e4054eb8af1ec93d0b8f9b27b71ec7ef94bebc9
                                                  • Opcode Fuzzy Hash: 6e3033d9ccef0e7e185a48753421e4d47c07fcdd5867c65b2f6808fb8f3ea5e3
                                                  • Instruction Fuzzy Hash: E441A271A00556BFEB24DAA8CC89EFABB6DFF08354F104527F904E7250DB31AD459BA0
                                                  Function 005DD6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,005D47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005D548E,?), ref: 005DD6DA
                                                  • GetLastError.KERNEL32(?,005D47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005D548E,?,?), ref: 005DD6E7
                                                  • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 005DD71F
                                                  • GetLastError.KERNEL32(?,005D47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005D548E,?,?), ref: 005DD72B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$AddressLibraryLoadProc
                                                  • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                  • API String ID: 1866314245-2276003667
                                                  • Opcode ID: 2cd57d80e6704131452ce19c287265d229a579432efe9ab84f9df03d3584fa2d
                                                  • Instruction ID: 08ce78651768dba4a68a5543989597c1af7607bf66f76e62e0c7632708f99e5a
                                                  • Opcode Fuzzy Hash: 2cd57d80e6704131452ce19c287265d229a579432efe9ab84f9df03d3584fa2d
                                                  • Instruction Fuzzy Hash: 0B110837A81732ABCB3147999C05F9B6EA5BB08761F064567FE14EB380D760DC0096E0
                                                  Function 005DF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 005DF942
                                                  • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 005DF94F
                                                  Strings
                                                  • Resume, xrefs: 005DF8B6
                                                  • Failed to open registration key., xrefs: 005DF8AB
                                                  • Failed to format pending restart registry key to read., xrefs: 005DF846
                                                  • %ls.RebootRequired, xrefs: 005DF82F
                                                  • Failed to read Resume value., xrefs: 005DF8D8
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Close
                                                  • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                  • API String ID: 3535843008-3890505273
                                                  • Opcode ID: f31ed0f4be4723d2ccec9ea3f93a8b2c8f7663a19b710f631eb29dce35913265
                                                  • Instruction ID: 99fdfd968de8b99e80970acca743aaf6131ccbc614d98e80ed353094477dc72a
                                                  • Opcode Fuzzy Hash: f31ed0f4be4723d2ccec9ea3f93a8b2c8f7663a19b710f631eb29dce35913265
                                                  • Instruction Fuzzy Hash: BC413871D01159FFDB219F9CC891AADBFA5FB04710F55817BE816AB310C371AE81AB81
                                                  Function 6CFD0948 Relevance: 12.1, APIs: 8, Instructions: 136COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • __RTC_Initialize.LIBCMT ref: 6CFD098F
                                                  • ___scrt_uninitialize_crt.LIBCMT ref: 6CFD09A9
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2191658015.000000006CFC1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFC0000, based on PE: true
                                                  • Associated: 00000002.00000002.2191600803.000000006CFC0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191805628.000000006CFFB000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191854894.000000006CFFD000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_6cfc0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Initialize___scrt_uninitialize_crt
                                                  • String ID:
                                                  • API String ID: 2442719207-0
                                                  • Opcode ID: 8fe1b5ca7a01970e1b9f08510e41593fbefb75dfdaaf47d1c46425a36c3977c2
                                                  • Instruction ID: 4ac1c859ba5408f3921413d01afb06ff36f64d3e4d2cc238978cbf6799b31121
                                                  • Opcode Fuzzy Hash: 8fe1b5ca7a01970e1b9f08510e41593fbefb75dfdaaf47d1c46425a36c3977c2
                                                  • Instruction Fuzzy Hash: BF41E572E05299EFDB20DF65C800BEE3A78EB81768F1B4156F814A7B50C7B1AD059B90
                                                  Function 00610523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(0063B5FC,00000000,?,?,?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?), ref: 00610533
                                                  • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0063B5F4,?,005E4207,00000000,Setup), ref: 006105D7
                                                  • GetLastError.KERNEL32(?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?,?,?), ref: 006105E7
                                                  • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?), ref: 00610621
                                                    • Part of subcall function 005D2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 005D2F09
                                                  • LeaveCriticalSection.KERNEL32(0063B5FC,?,?,0063B5F4,?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?), ref: 0061067A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                  • String ID: logutil.cpp
                                                  • API String ID: 4111229724-3545173039
                                                  • Opcode ID: 090e7b0121810553e430494c2d3efded9c3b84f3d13decc4822d4f9edf7e3d95
                                                  • Instruction ID: c5242c10cd4585519a75edf499aaeaa61956ec8da59b97ee45995c400a7565bc
                                                  • Opcode Fuzzy Hash: 090e7b0121810553e430494c2d3efded9c3b84f3d13decc4822d4f9edf7e3d95
                                                  • Instruction Fuzzy Hash: 0031DB3190025AFBEF219F648D45EEE76BBEB40755F095126FA00A6260D7B1CDE09BD0
                                                  Function 005F0B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Unexpected call to CabWrite()., xrefs: 005F0BC1
                                                  • Failed to write during cabinet extraction., xrefs: 005F0C35
                                                  • cabextract.cpp, xrefs: 005F0C2B
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastWrite_memcpy_s
                                                  • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                  • API String ID: 1970631241-3111339858
                                                  • Opcode ID: 9572f5858d330c07df90116fbae33396ea4fa377ef24c542d76741654a78d167
                                                  • Instruction ID: 51e1493482750b09d951972675d7973893867d87a7872743446d7b4722b29f25
                                                  • Opcode Fuzzy Hash: 9572f5858d330c07df90116fbae33396ea4fa377ef24c542d76741654a78d167
                                                  • Instruction Fuzzy Hash: B621D476500109ABCB10DF5DD985D6A7BAAFF88320B1A515AFF04C7292D675DD00DB60
                                                  Function 00610879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • OpenProcessToken.ADVAPI32(?,00000008,?,005D53BD,00000000,?,?,?,?,?,?,?,005E769D,00000000), ref: 00610897
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,005E769D,00000000), ref: 006108A1
                                                  • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,005E769D,00000000), ref: 006108D3
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,005E769D,00000000), ref: 006108EC
                                                  • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,005E769D,00000000), ref: 0061092B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                  • String ID: procutil.cpp
                                                  • API String ID: 4040495316-1178289305
                                                  • Opcode ID: 787110d61a26ffb3b2843be001e55672c37559b40b2375fed251d00f41aac39e
                                                  • Instruction ID: ea0f7b0e74539820fe2b8980c0bf68575df64411c1b433229a63f91fad731ccf
                                                  • Opcode Fuzzy Hash: 787110d61a26ffb3b2843be001e55672c37559b40b2375fed251d00f41aac39e
                                                  • Instruction Fuzzy Hash: 1B21F672D00229EBFF209B958804ADEBBB9EF04711F099166ED15EB350D3B08E80DAD0
                                                  Function 005F0C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 005F0CC4
                                                  • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005F0CD6
                                                  • SetFileTime.KERNELBASE(?,?,?,?), ref: 005F0CE9
                                                  • CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,005F08B1,?,?), ref: 005F0CF8
                                                  Strings
                                                  • Invalid operation for this state., xrefs: 005F0C9D
                                                  • cabextract.cpp, xrefs: 005F0C93
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Time$File$CloseDateHandleLocal
                                                  • String ID: Invalid operation for this state.$cabextract.cpp
                                                  • API String ID: 609741386-1751360545
                                                  • Opcode ID: a66c0320de1f0e36d63e2f7fefdf2ea494d08ff4b4c4dbd3c09c28500c48a39f
                                                  • Instruction ID: b9adc3eaf1683f36a32c1775265932f600e746b50bc0c5c969b75d0d02961060
                                                  • Opcode Fuzzy Hash: a66c0320de1f0e36d63e2f7fefdf2ea494d08ff4b4c4dbd3c09c28500c48a39f
                                                  • Instruction Fuzzy Hash: 8921F37280061EAB8B109FA8DD098FABFADFF083207589216F954D71D1D374EA51CB90
                                                  Function 00613565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CoInitialize.OLE32(00000000), ref: 00613574
                                                  • InterlockedIncrement.KERNEL32(0063B6C8), ref: 00613591
                                                  • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0063B6B8,?,?,?,?,?,?), ref: 006135AC
                                                  • CLSIDFromProgID.OLE32(MSXML.DOMDocument,0063B6B8,?,?,?,?,?,?), ref: 006135B8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FromProg$IncrementInitializeInterlocked
                                                  • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                  • API String ID: 2109125048-2356320334
                                                  • Opcode ID: 946fea0a4ef2e291daa49dd346e9a8a5c5d3698fcd498ff0485308b09945d6f8
                                                  • Instruction ID: 85ff215c066126b76b2de2e9708da69300cefa1586c18d3b557f1570e061a503
                                                  • Opcode Fuzzy Hash: 946fea0a4ef2e291daa49dd346e9a8a5c5d3698fcd498ff0485308b09945d6f8
                                                  • Instruction Fuzzy Hash: CFF0E53074013567C3210B62BD0ABD72D6BDB82F54F1D742AF902C2354D370CA8186F0
                                                  Function 00614A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00614A9D
                                                  • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00614ACA
                                                  • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00614AF6
                                                  • GetLastError.KERNEL32(00000000,0061B7A0,?,00000000,?,00000000,?,00000000), ref: 00614B34
                                                  • GlobalFree.KERNEL32(00000000), ref: 00614B65
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$Global$AllocFree
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 1145190524-2967768451
                                                  • Opcode ID: a2af5f161a8fdab44249b4ac783c7add6dd778c2b3e815800aefc7ee316ff430
                                                  • Instruction ID: 626a51297a4fe8f6d299dcd0ecac311351ce79026e31b599e068b15aa745247d
                                                  • Opcode Fuzzy Hash: a2af5f161a8fdab44249b4ac783c7add6dd778c2b3e815800aefc7ee316ff430
                                                  • Instruction Fuzzy Hash: 43310837D44229ABC7219A99CC41FEFBABAAF44750F1A4116FD04E7340DB30DD4096E4
                                                  Function 005EE956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • DefWindowProcW.USER32(?,00000082,?,?), ref: 005EE985
                                                  • SetWindowLongW.USER32(?,000000EB,00000000), ref: 005EE994
                                                  • SetWindowLongW.USER32(?,000000EB,?), ref: 005EE9A8
                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 005EE9B8
                                                  • GetWindowLongW.USER32(?,000000EB), ref: 005EE9D2
                                                  • PostQuitMessage.USER32(00000000), ref: 005EEA31
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Window$Long$Proc$MessagePostQuit
                                                  • String ID:
                                                  • API String ID: 3812958022-0
                                                  • Opcode ID: 9ed91499f58d97580cbd1cfa0e4b20b14c55d336afff86f2354886c7f489ca31
                                                  • Instruction ID: 111e2f8dc3a392a74d857bf0dc8484321083eebc0c5a9fd1731d814c9bae05ea
                                                  • Opcode Fuzzy Hash: 9ed91499f58d97580cbd1cfa0e4b20b14c55d336afff86f2354886c7f489ca31
                                                  • Instruction Fuzzy Hash: 9A21B031104145BFDB199F68DD0EEAA3F66FF48350F148629F95AAA1A4C731DD20DB50
                                                  Function 005F0A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 005F0B27
                                                  • GetLastError.KERNEL32(?,?,?), ref: 005F0B31
                                                  Strings
                                                  • Failed to move file pointer 0x%x bytes., xrefs: 005F0B62
                                                  • Invalid seek type., xrefs: 005F0ABD
                                                  • cabextract.cpp, xrefs: 005F0B55
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastPointer
                                                  • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                  • API String ID: 2976181284-417918914
                                                  • Opcode ID: a8ebea13aebc812ce65b8fad950f40bde188ac4f38d9cb97738e5d76ffa6c73d
                                                  • Instruction ID: 7523104f8a1bd60878beca64a8fbb6719b5eff83a43c68022093e5333d1fb68f
                                                  • Opcode Fuzzy Hash: a8ebea13aebc812ce65b8fad950f40bde188ac4f38d9cb97738e5d76ffa6c73d
                                                  • Instruction Fuzzy Hash: AD31A331A4061EEFCB10DFA8D844DBEBB65FB08724B198515FA1497292D374ED109BD0
                                                  Function 005D4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,005EA0E8,00000000,00000000,?,00000000,005D53BD,00000000,?,?,005DD5B5,?), ref: 005D4123
                                                  • GetLastError.KERNEL32(?,005EA0E8,00000000,00000000,?,00000000,005D53BD,00000000,?,?,005DD5B5,?,00000000,00000000), ref: 005D4131
                                                  • CreateDirectoryW.KERNEL32(?,840F01E8,005D5489,?,005EA0E8,00000000,00000000,?,00000000,005D53BD,00000000,?,?,005DD5B5,?,00000000), ref: 005D419A
                                                  • GetLastError.KERNEL32(?,005EA0E8,00000000,00000000,?,00000000,005D53BD,00000000,?,?,005DD5B5,?,00000000,00000000), ref: 005D41A4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CreateDirectoryErrorLast
                                                  • String ID: dirutil.cpp
                                                  • API String ID: 1375471231-2193988115
                                                  • Opcode ID: 35d461dc6b16b8a6c9ddab805151957f7bcdfb256c51f8129e285e2de200d235
                                                  • Instruction ID: 268ef514862b98858ca4873c86cb1c9daf9e7d810504975731315819f0bb7c7f
                                                  • Opcode Fuzzy Hash: 35d461dc6b16b8a6c9ddab805151957f7bcdfb256c51f8129e285e2de200d235
                                                  • Instruction Fuzzy Hash: 84110226600736A7DB311AED8C44B7BAE65FFB5B61F154023FD08EA340E3748C80DA91
                                                  Function 6CFD09F8 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2191658015.000000006CFC1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFC0000, based on PE: true
                                                  • Associated: 00000002.00000002.2191600803.000000006CFC0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191805628.000000006CFFB000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191854894.000000006CFFD000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_6cfc0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: dllmain_raw$dllmain_crt_dispatch
                                                  • String ID:
                                                  • API String ID: 3136044242-0
                                                  • Opcode ID: 408a3605e990da1de083d9da4f0073c62be016e57e1f2de8845f9c40a5f96edd
                                                  • Instruction ID: 8d7222b7e023933205f0eb541d74fa0617a245f30f0f3a22fd2456dc18b9e35f
                                                  • Opcode Fuzzy Hash: 408a3605e990da1de083d9da4f0073c62be016e57e1f2de8845f9c40a5f96edd
                                                  • Instruction Fuzzy Hash: 1321E572E01299EFCB259E15C840EEF3A78EB81B98F0B4156F81497B10C3B1AD01DBE0
                                                  Function 6CFC6EF9 Relevance: 7.6, APIs: 5, Instructions: 68sleepprocessCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32 ref: 6CFC6F0A
                                                  • GetModuleFileNameW.KERNEL32(?,00000104), ref: 6CFC6F22
                                                  • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6CFC6FB7
                                                  • Sleep.KERNELBASE ref: 6CFC6FC3
                                                  • ExitProcess.KERNEL32 ref: 6CFC6FCA
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2191658015.000000006CFC1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFC0000, based on PE: true
                                                  • Associated: 00000002.00000002.2191600803.000000006CFC0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191805628.000000006CFFB000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191854894.000000006CFFD000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_6cfc0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ModuleProcess$CreateExitFileHandleNameSleep
                                                  • String ID:
                                                  • API String ID: 1732164044-0
                                                  • Opcode ID: 5b21e26bb409c5a2bb631149adb48a7267ee6d7b8c542cdb4d90b297d8c17b2c
                                                  • Instruction ID: 312169d7a0084d58d27a64970547a331fab3916f5ba49e16489378ddfbadbef7
                                                  • Opcode Fuzzy Hash: 5b21e26bb409c5a2bb631149adb48a7267ee6d7b8c542cdb4d90b297d8c17b2c
                                                  • Instruction Fuzzy Hash: AA21CD72B54118AACB51AB98DC44BBF3BB8FB49744F10056AB715E70A0E7B00854CB59
                                                  Function 005E3AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00610F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0063AAA0,00000000,?,006157E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00610F80
                                                  • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,005E3FB5,feclient.dll,?,00000000,?,?,?,005D4B12), ref: 005E3B42
                                                    • Part of subcall function 006110B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0061112B
                                                    • Part of subcall function 006110B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00611163
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue$CloseOpen
                                                  • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                  • API String ID: 1586453840-3596319545
                                                  • Opcode ID: b6b68c8075a358c6e94759d1e0a826d6893e09b67fa73ec3943e3056bd3f2fdf
                                                  • Instruction ID: e4a151b315f30bebf5eed426774bded95c9a259fe5d8b2193bf57473942ae883
                                                  • Opcode Fuzzy Hash: b6b68c8075a358c6e94759d1e0a826d6893e09b67fa73ec3943e3056bd3f2fdf
                                                  • Instruction Fuzzy Hash: 2811D332B40358BBDB25DA96DC8AEAABFBDFB04700F400065E6429B150D6719F81D750
                                                  Function 00610764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenA.KERNEL32(005F12CF,00000000,00000000,?,?,?,00610013,005F12CF,005F12CF,?,00000000,0000FDE9,?,005F12CF,8007139F,Invalid operation for this state.), ref: 00610776
                                                  • WriteFile.KERNELBASE(00000214,00000000,00000000,?,00000000,?,?,00610013,005F12CF,005F12CF,?,00000000,0000FDE9,?,005F12CF,8007139F), ref: 006107B2
                                                  • GetLastError.KERNEL32(?,?,00610013,005F12CF,005F12CF,?,00000000,0000FDE9,?,005F12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006107BC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastWritelstrlen
                                                  • String ID: logutil.cpp
                                                  • API String ID: 606256338-3545173039
                                                  • Opcode ID: e2b3c8f8f51a7a2384c0a71d35ea9bd5e39f1191ab9b7a5cab9ad3ff4c186dd7
                                                  • Instruction ID: 4132d410d0316d460610c94dff1a33851d12f7ae382852dc0f0ed07a490a573e
                                                  • Opcode Fuzzy Hash: e2b3c8f8f51a7a2384c0a71d35ea9bd5e39f1191ab9b7a5cab9ad3ff4c186dd7
                                                  • Instruction Fuzzy Hash: 6411EC76901125FB97208A69CC84DEFBA6EFB44761F154215FD10D7280D7B0ED80CAE0
                                                  Function 005F09EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 005F140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005F0A19,?,?,?), ref: 005F1434
                                                    • Part of subcall function 005F140C: GetLastError.KERNEL32(?,005F0A19,?,?,?), ref: 005F143E
                                                  • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 005F0A27
                                                  • GetLastError.KERNEL32 ref: 005F0A31
                                                  Strings
                                                  • Failed to read during cabinet extraction., xrefs: 005F0A5F
                                                  • cabextract.cpp, xrefs: 005F0A55
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLast$PointerRead
                                                  • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                  • API String ID: 2170121939-2426083571
                                                  • Opcode ID: 797a9bdce55985c69bef28bc32b453e49d36214424a2e74797fa29cc5d2027a2
                                                  • Instruction ID: be0c16ac6c1a1b2492793adc7ba04d7147d557cfad049143780a418f736889d2
                                                  • Opcode Fuzzy Hash: 797a9bdce55985c69bef28bc32b453e49d36214424a2e74797fa29cc5d2027a2
                                                  • Instruction Fuzzy Hash: B111E137A00629FBCB219F95DC08EAE7F6AFF48760B064159FE04A7291D7349910DBD4
                                                  Function 005F140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005F0A19,?,?,?), ref: 005F1434
                                                  • GetLastError.KERNEL32(?,005F0A19,?,?,?), ref: 005F143E
                                                  Strings
                                                  • Failed to move to virtual file pointer., xrefs: 005F146C
                                                  • cabextract.cpp, xrefs: 005F1462
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileLastPointer
                                                  • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                  • API String ID: 2976181284-3005670968
                                                  • Opcode ID: dd5b843c7bb9b2a283eff6dfa79524bec6e2f4cef9ed590f7f7d4f52aa3cbdbe
                                                  • Instruction ID: c74d05525e032debe2e7df05cb85eefa4af2ff22df594806f81b14193005dd33
                                                  • Opcode Fuzzy Hash: dd5b843c7bb9b2a283eff6dfa79524bec6e2f4cef9ed590f7f7d4f52aa3cbdbe
                                                  • Instruction Fuzzy Hash: 0501F737900A3AB7CB214A969C0CA9BBF15FF807717168126FE285A101DB759C10DAD8
                                                  Function 005F07B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SetEvent.KERNEL32(0061B478,00000000,?,005F1717,?,00000000,?,005DC287,?,005D5405,?,005E75A5,?,?,005D5405,?), ref: 005F07BF
                                                  • GetLastError.KERNEL32(?,005F1717,?,00000000,?,005DC287,?,005D5405,?,005E75A5,?,?,005D5405,?,005D5445,00000001), ref: 005F07C9
                                                  Strings
                                                  • cabextract.cpp, xrefs: 005F07ED
                                                  • Failed to set begin operation event., xrefs: 005F07F7
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorEventLast
                                                  • String ID: Failed to set begin operation event.$cabextract.cpp
                                                  • API String ID: 3848097054-4159625223
                                                  • Opcode ID: efdc29f1d27609084145d1ab877afd3137fde2b113e2920fd957d7348180da66
                                                  • Instruction ID: e1b1711293a268489bb5007a79ea720e966febab5b4754790a17fc7b090a9ef2
                                                  • Opcode Fuzzy Hash: efdc29f1d27609084145d1ab877afd3137fde2b113e2920fd957d7348180da66
                                                  • Instruction Fuzzy Hash: FAF0543794353557873063D55C09ADF7E45BF04BB17061126FF00B7181E654AC00C6D9
                                                  Function 6CFD73FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2191658015.000000006CFC1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFC0000, based on PE: true
                                                  • Associated: 00000002.00000002.2191600803.000000006CFC0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191718870.000000006CFEA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191805628.000000006CFFB000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                  • Associated: 00000002.00000002.2191854894.000000006CFFD000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_6cfc0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: C:\Windows\Temp\{044E4F6C-BF91-4D1D-88E8-2A6D53E18C6F}\.cr\8Rmoal0v85.exe
                                                  • API String ID: 0-3169554973
                                                  • Opcode ID: 2da79d95175009a0d7c25c2cc0e6f152f83f3c7830e8e7278bbfe90ccae8d164
                                                  • Instruction ID: 05fc0406c36a24c7f04d6a46dcffd53a3c512fed594e11dd944c76ed7d8e187c
                                                  • Opcode Fuzzy Hash: 2da79d95175009a0d7c25c2cc0e6f152f83f3c7830e8e7278bbfe90ccae8d164
                                                  • Instruction Fuzzy Hash: 8241A071A14614EBCB22AF9DD880ADEBFBCEB86314B1A4167E410DB704D770AA44CB91
                                                  Function 005D5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,005D1104,?,?,00000000), ref: 005D5142
                                                  • CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,005D1104,?,?,00000000), ref: 005D5172
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareStringlstrlen
                                                  • String ID: burn.clean.room
                                                  • API String ID: 1433953587-3055529264
                                                  • Opcode ID: b68c28871711bc8bf896cccbcc8ad78515b0ca0dc1176a9f36b6d6202f6d9d43
                                                  • Instruction ID: a281c003c2de437a914f12fd277ecb040f43e272b1d428a819d5ccd479725175
                                                  • Opcode Fuzzy Hash: b68c28871711bc8bf896cccbcc8ad78515b0ca0dc1176a9f36b6d6202f6d9d43
                                                  • Instruction Fuzzy Hash: DD014F725005247E87308BCC9D88A63BFAEF715760B145117F585C2710E7709C41D6E2
                                                  Function 005D3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005D3877
                                                  • GetLastError.KERNEL32 ref: 005D3881
                                                  • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 005D38EA
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: DirectoryErrorLastLibraryLoadSystem
                                                  • String ID:
                                                  • API String ID: 1230559179-0
                                                  • Opcode ID: d56238147e8fc6f910f4285ae383c31e0a48874f2937f260ddeb54ca9ad07d62
                                                  • Instruction ID: 4c7f0b20b808d3f472fa5eef25c62ddf50f65aed3bb8e33afd5ceb1c74c84aad
                                                  • Opcode Fuzzy Hash: d56238147e8fc6f910f4285ae383c31e0a48874f2937f260ddeb54ca9ad07d62
                                                  • Instruction Fuzzy Hash: 7321D3B2D0122DA7DB309F698C49F9A7BA8BB44750F1501A7BE14E7341EA70DE408BE1
                                                  Function 005D3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,005D3BB6,00000000,?,005D1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,005D13B8), ref: 005D3A20
                                                  • RtlFreeHeap.NTDLL(00000000,?,005D3BB6,00000000,?,005D1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,005D13B8,000001C7,00000100), ref: 005D3A27
                                                  • GetLastError.KERNEL32(?,005D3BB6,00000000,?,005D1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,005D13B8,000001C7,00000100,?), ref: 005D3A31
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$ErrorFreeLastProcess
                                                  • String ID:
                                                  • API String ID: 406640338-0
                                                  • Opcode ID: 791cec9eab4ad296c601a10173c63db7eac1b46e5dd620e26283f0611b597afd
                                                  • Instruction ID: 672b89193acc40e1b1efbb9b7840dec5db0ad105f1ef4eea782511447040d412
                                                  • Opcode Fuzzy Hash: 791cec9eab4ad296c601a10173c63db7eac1b46e5dd620e26283f0611b597afd
                                                  • Instruction Fuzzy Hash: 45D0C233A0013967833017EA5C0D99B7E58EF04AA27065023FD48D6220D721CC0082E5
                                                  Function 005DF755 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00610F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0063AAA0,00000000,?,006157E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00610F80
                                                  • RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,005E7D59,?,?,?), ref: 005DF7B9
                                                    • Part of subcall function 00611026: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,?,00000000,?,?,?,005DF78E,00000000,Installed,00000000,?), ref: 0061104B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseOpenQueryValue
                                                  • String ID: Installed
                                                  • API String ID: 3677997916-3662710971
                                                  • Opcode ID: 0d395764a7ce43375c9af2f95a511ff127315d29352ce9e078d3d91792938ed6
                                                  • Instruction ID: bca315772494e703966b76525973221e26c3bced425b5701ce068700859d1e0b
                                                  • Opcode Fuzzy Hash: 0d395764a7ce43375c9af2f95a511ff127315d29352ce9e078d3d91792938ed6
                                                  • Instruction Fuzzy Hash: 2101A236820128FFCB21DBA8CC46BDEBBB9EF04711F1541AAF800AB210D7755E80DB90
                                                  Function 00610F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0063AAA0,00000000,?,006157E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00610F80
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open
                                                  • String ID: regutil.cpp
                                                  • API String ID: 71445658-955085611
                                                  • Opcode ID: fb21c678aa4f4002650b897bc49fba140fdd0e995b728fa5d2aa2ea994e1e902
                                                  • Instruction ID: 0e8afd3cb4c921f6d8a233691b75d3aefbda6c22d6c1465f52851a6aa3772bd4
                                                  • Opcode Fuzzy Hash: fb21c678aa4f4002650b897bc49fba140fdd0e995b728fa5d2aa2ea994e1e902
                                                  • Instruction Fuzzy Hash: 93F0C832601132AEAF3019558C07AEBAA47DB857A0F2D8125BD469A290D6A18CC296F1
                                                  Function 0060F479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0060F491
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: 3fed36c28a51ee68a75219b6ea51af60ab0d7ef6a16908d9e1601ca08c36ee0d
                                                  • Instruction ID: 727b0a0cc108b343abe930203036402b5ec824d994cad614a835ef8c04c56b78
                                                  • Opcode Fuzzy Hash: 3fed36c28a51ee68a75219b6ea51af60ab0d7ef6a16908d9e1601ca08c36ee0d
                                                  • Instruction Fuzzy Hash: FBB012B52B95017C724C52501C16C7B010FC1C1F21735C66EB840D10C1A8C04E4220F2
                                                  Function 0060F4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0060F491
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: af417bd4d62ec83e891ed9aaf583e97c3922ef0e6ad1e979bad3497607d4e4e2
                                                  • Instruction ID: 840c0a9de8e21faf47dd9738fc90061c40180673e7db6844dbc383d1c0f96185
                                                  • Opcode Fuzzy Hash: af417bd4d62ec83e891ed9aaf583e97c3922ef0e6ad1e979bad3497607d4e4e2
                                                  • Instruction Fuzzy Hash: 72B012B12B96016C728C92541C12D7B014FC1C5F2173586AEF440C20C1E8C04E8220F2
                                                  Function 0060F49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0060F491
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID: PAyn
                                                  • API String ID: 1269201914-3488004521
                                                  • Opcode ID: 8a468a3a5ba3ed2943fa87d6f3e8bbb784a5dd5af9dfa8951760179bdb10af81
                                                  • Instruction ID: 0b5613f9391cb95f85887b1c4154c1b326fcfe42f321bc32b9d99dee6d20096a
                                                  • Opcode Fuzzy Hash: 8a468a3a5ba3ed2943fa87d6f3e8bbb784a5dd5af9dfa8951760179bdb10af81
                                                  • Instruction Fuzzy Hash: BFB012B12B9501AD728C92541D13D7B014FC1D5F21735456EB440C20C1E8C04E4320F2
                                                  Function 005D3AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(?,000001C7,?,?,005D226D,?,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000), ref: 005D3B04
                                                  • RtlReAllocateHeap.NTDLL(00000000,?,005D226D,?,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3B0B
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateProcess
                                                  • String ID:
                                                  • API String ID: 1357844191-0
                                                  • Opcode ID: 0ac82c2e253551d39d09e72873dc2b722bcccb399ca09cc38087db402d177e83
                                                  • Instruction ID: c397ad9900c7681d34c8743e437b5ebcbe9c9461207d3ebda9bd410624c01e44
                                                  • Opcode Fuzzy Hash: 0ac82c2e253551d39d09e72873dc2b722bcccb399ca09cc38087db402d177e83
                                                  • Instruction Fuzzy Hash: 8FD0C93219424DBB8F005FE8DC0EDAA3BADEB586027089406B915C2120C739E4209A60
                                                  Function 005D394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetProcessHeap.KERNEL32(?,000001C7,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3960
                                                  • RtlAllocateHeap.NTDLL(00000000,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3967
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Heap$AllocateProcess
                                                  • String ID:
                                                  • API String ID: 1357844191-0
                                                  • Opcode ID: 35747d47db351c1be6e7274ed00110072359c15e99bbe4f28f7a4af9c3105d07
                                                  • Instruction ID: 5d3dad66c08d89259a62308552f56bb54debc8a28355226d11e05cd787c1d16d
                                                  • Opcode Fuzzy Hash: 35747d47db351c1be6e7274ed00110072359c15e99bbe4f28f7a4af9c3105d07
                                                  • Instruction Fuzzy Hash: 1BC012321A420CBB8B006FF8EC0EC9A3BADBB28602708E402B905C2120C738E0108B60
                                                  Function 006135C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • VariantInit.OLEAUT32(?), ref: 006135F8
                                                    • Part of subcall function 0061304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00613609,00000000,?,00000000), ref: 00613069
                                                    • Part of subcall function 0061304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,005FC025,?,005D5405,?,00000000,?), ref: 00613075
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorHandleInitLastModuleVariant
                                                  • String ID:
                                                  • API String ID: 52713655-0
                                                  • Opcode ID: 389eb527462cf4f92e9b08b982e79ade6624dd97cfa257f7566b94fd3a2370f7
                                                  • Instruction ID: 34e1185f122e97db54e1538e6b0cb079b91e22d535257f560f4890e69c258f28
                                                  • Opcode Fuzzy Hash: 389eb527462cf4f92e9b08b982e79ade6624dd97cfa257f7566b94fd3a2370f7
                                                  • Instruction Fuzzy Hash: 63314D76E00229AFCB11DFA8C884ADEB7F9EF08710F05456AED15AB311DA759D408BA4
                                                  Function 0060521A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • RtlAllocateHeap.NTDLL(00000000,?,?,?,00601F87,?,0000015D,?,?,?,?,006033E0,000000FF,00000000,?,?), ref: 0060524C
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AllocateHeap
                                                  • String ID:
                                                  • API String ID: 1279760036-0
                                                  • Opcode ID: dc7adb8573cecc4bd078f7a60bc5d1fd6460c95f98e105c0192df6faacfd0084
                                                  • Instruction ID: 3deeb2a16dfa62336aed57f3f5d7594ccf10fb60ee427a1f095b1046a27b2de3
                                                  • Opcode Fuzzy Hash: dc7adb8573cecc4bd078f7a60bc5d1fd6460c95f98e105c0192df6faacfd0084
                                                  • Instruction Fuzzy Hash: 5FE02B315C0A606ED73926659C05BDB374F9F923B1F251215AD13922D0CF70CF418DE5
                                                  Function 005D34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,005E8BD3,0000001C,80070490,00000000,00000000,80070490), ref: 005D34D5
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: FolderPath
                                                  • String ID:
                                                  • API String ID: 1514166925-0
                                                  • Opcode ID: 2bc1281ce3163e22c5a786cdb3f106c4aaa76e92e8c7248a5fe60d4ce30296d4
                                                  • Instruction ID: 4b26c74ffad8ba65003e9ddad190d8b2639799f9a9c9731874419582a627652c
                                                  • Opcode Fuzzy Hash: 2bc1281ce3163e22c5a786cdb3f106c4aaa76e92e8c7248a5fe60d4ce30296d4
                                                  • Instruction Fuzzy Hash: B8E012722011257BEB222E695C09DEB7F5CFF55354B008053BE40E6210D766D55096B5
                                                  Function 00619674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0061966B
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: 320fe192223cedbb9afdff2da2efb2d7dc94119be479bd30986a2ab647077b8b
                                                  • Instruction ID: 161f9d78036efd33b46127f7037aded9bc8d277cc0c106e694bcabda43214914
                                                  • Opcode Fuzzy Hash: 320fe192223cedbb9afdff2da2efb2d7dc94119be479bd30986a2ab647077b8b
                                                  • Instruction Fuzzy Hash: B3B012A12781426C368851441C17DB7450FC9C0B12739C51EB400D2080E8400D8D61F2
                                                  Function 00619653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0061966B
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: e1ff94f344c8a266a62b638835b02c68c74631d9dc9da55d6d55494c81d60f0e
                                                  • Instruction ID: 37c118fd6dd67a97c5a17cf2cbf7875af2b61bf0f13c135ad04648b3755d522a
                                                  • Opcode Fuzzy Hash: e1ff94f344c8a266a62b638835b02c68c74631d9dc9da55d6d55494c81d60f0e
                                                  • Instruction Fuzzy Hash: A5B012A12782457C3A4811406C92CB7450FCEC0B2173A851EB000F1090A8400E8562F7
                                                  Function 00619684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ___delayLoadHelper2@8.DELAYIMP ref: 0061966B
                                                    • Part of subcall function 0061998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00619A09
                                                    • Part of subcall function 0061998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00619A1A
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                  • String ID:
                                                  • API String ID: 1269201914-0
                                                  • Opcode ID: b034f06d0f7ee3f333fff12759be852214d116752656d2f6c067e6e8ac5d5a1b
                                                  • Instruction ID: f7df63584e303eb32686770895906e76f7636deca33e69e4ceda2126457bbfd3
                                                  • Opcode Fuzzy Hash: b034f06d0f7ee3f333fff12759be852214d116752656d2f6c067e6e8ac5d5a1b
                                                  • Instruction Fuzzy Hash: BDB012A1278341AC7A8851842E53DB7450FCEC0B21739451EB000E2190E8400D8661F2

                                                  Non-executed Functions

                                                  Function 0061710D Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 298COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00633E78,000000FF,?,?,?), ref: 006171D4
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 006171F9
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00617219
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00617235
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 0061725D
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00617279
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 006172B2
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 006172EB
                                                    • Part of subcall function 00616D50: SysFreeString.OLEAUT32(00000000), ref: 00616E89
                                                    • Part of subcall function 00616D50: SysFreeString.OLEAUT32(00000000), ref: 00616EC8
                                                  • SysFreeString.OLEAUT32(00000000), ref: 0061736F
                                                  • SysFreeString.OLEAUT32(00000000), ref: 0061741F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$Compare$Free
                                                  • String ID: ($`Dv$atomutil.cpp$author$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
                                                  • API String ID: 318886736-507169720
                                                  • Opcode ID: cd3b01d8998ad8e245805d12e629efd56528e654d89e7518eef2ea1e92dc10ff
                                                  • Instruction ID: bc9b0359e65eef568f479bf3d0162f634c4301181eaaedb7598e978484ef2d59
                                                  • Opcode Fuzzy Hash: cd3b01d8998ad8e245805d12e629efd56528e654d89e7518eef2ea1e92dc10ff
                                                  • Instruction Fuzzy Hash: 99A19331948216BBDB219B54CC41FEDBB76AF04730F284355F921A72D1DB70EA90DB91
                                                  Function 00618134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00618161
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 0061817C
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 0061821F
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,0061B518,00000000), ref: 0061825E
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 006182B1
                                                  • CompareStringW.KERNEL32(0000007F,00000000,0061B518,000000FF,true,000000FF), ref: 006182CF
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00618307
                                                  • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 0061844B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CompareString
                                                  • String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
                                                  • API String ID: 1825529933-3037633208
                                                  • Opcode ID: 2ce7ae44d647cf34d36b1bd1f6f3998365625ac4c63adf9d8b3723a52eeab5a7
                                                  • Instruction ID: 332367c7edf9475ff8147ec8176c9390a8d9992c17a3e374cabaf549e9011f10
                                                  • Opcode Fuzzy Hash: 2ce7ae44d647cf34d36b1bd1f6f3998365625ac4c63adf9d8b3723a52eeab5a7
                                                  • Instruction Fuzzy Hash: 51B16C31544606AFCB21CF94CC85FDA7BA7AB44730F298659F925AB2E1DF70E981CB40
                                                  Function 005DA03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • _MREFOpen@16.MSPDB140-MSVCRT ref: 005DA0B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Open@16
                                                  • String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
                                                  • API String ID: 3613110473-2134270738
                                                  • Opcode ID: 27f2fe7b268a803cc20e9c2e4f9cb1e2a1eb77c1cbb2f77be38d8e81bd368c6c
                                                  • Instruction ID: 63eeab3913484585142b7d47456e5e39b849576d452c8c60d1fdec281c825da5
                                                  • Opcode Fuzzy Hash: 27f2fe7b268a803cc20e9c2e4f9cb1e2a1eb77c1cbb2f77be38d8e81bd368c6c
                                                  • Instruction Fuzzy Hash: D561B032D40119ABCB319AAD8D4ADEF7E6ABB48310F180457F904BA351D273DE80D796
                                                  Function 005EF051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 005D394F: GetProcessHeap.KERNEL32(?,000001C7,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3960
                                                    • Part of subcall function 005D394F: RtlAllocateHeap.NTDLL(00000000,?,005D2274,000001C7,00000001,80004005,8007139F,?,?,00610267,8007139F,?,00000000,00000000,8007139F), ref: 005D3967
                                                  • EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 005EF06E
                                                  • LeaveCriticalSection.KERNEL32(?), ref: 005EF19B
                                                  Strings
                                                  • UX requested unknown approved exe with id: %ls, xrefs: 005EF0CE
                                                  • Failed to copy the id., xrefs: 005EF100
                                                  • user is active, cannot change user state., xrefs: 005EF089
                                                  • userForApplication.cpp, xrefs: 005EF17C
                                                  • Failed to copy the arguments., xrefs: 005EF12D
                                                  • Failed to post launch approved exe message., xrefs: 005EF186
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CriticalHeapSection$AllocateEnterLeaveProcess
                                                  • String ID: user is active, cannot change user state.$userForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
                                                  • API String ID: 1367039788-528931743
                                                  • Opcode ID: f934f236183b720fa4215c798f4dc090133183c3a8fa04efaab7d529bfa79c41
                                                  • Instruction ID: 7000f401693b9d0cfed797808d0eb63620029e525a5d85d2a53eac50df2567e3
                                                  • Opcode Fuzzy Hash: f934f236183b720fa4215c798f4dc090133183c3a8fa04efaab7d529bfa79c41
                                                  • Instruction Fuzzy Hash: F831E932A41665EBDB299F65DC09E5B3F99BF04720B068426FC44EF251DB71DD00C790
                                                  Function 005D6037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetSystemTime.KERNEL32(?), ref: 005D6062
                                                  • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 005D6076
                                                  • GetLastError.KERNEL32 ref: 005D6088
                                                  • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 005D60DC
                                                  • GetLastError.KERNEL32 ref: 005D60E6
                                                  Strings
                                                  • Failed to set variant value., xrefs: 005D6124
                                                  • variable.cpp, xrefs: 005D60A3, 005D6101
                                                  • Failed to get the Date., xrefs: 005D610B
                                                  • Failed to allocate the buffer for the Date., xrefs: 005D60C4
                                                  • Failed to get the required buffer length for the Date., xrefs: 005D60AD
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: DateErrorFormatLast$SystemTime
                                                  • String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 2700948981-3682088697
                                                  • Opcode ID: 7ea504f25c07254f8c7716121ea57c582c67cdfc8cd466fb27c54c29c88443ff
                                                  • Instruction ID: 8fb196a1f37fbd60bf444c12dff8e369f8c2948ec8d6053ac326d00e76ad853b
                                                  • Opcode Fuzzy Hash: 7ea504f25c07254f8c7716121ea57c582c67cdfc8cd466fb27c54c29c88443ff
                                                  • Instruction Fuzzy Hash: A231B732A4022A7BDB319BED8C46EEFBEA9BB44710F150427FE00F7381D6649D4196E1
                                                  Function 005E41EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00610523: EnterCriticalSection.KERNEL32(0063B5FC,00000000,?,?,?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?), ref: 00610533
                                                    • Part of subcall function 00610523: LeaveCriticalSection.KERNEL32(0063B5FC,?,?,0063B5F4,?,005E4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,005D54FA,?), ref: 0061067A
                                                  • OpenEventLogW.ADVAPI32(00000000,Application), ref: 005E4212
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005E421E
                                                  • ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,006239D4,00000000), ref: 005E426B
                                                  • CloseEventLog.ADVAPI32(00000000), ref: 005E4272
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
                                                  • String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
                                                  • API String ID: 1844635321-1389066741
                                                  • Opcode ID: 1cf0cc4638f4b32f0e61fe700dab559c62a89657f5ad8775c901dde27793280b
                                                  • Instruction ID: 38ec947593343057fa211a366f3023b32720c7aabe7cf8b3e56a3eb1e3b64a48
                                                  • Opcode Fuzzy Hash: 1cf0cc4638f4b32f0e61fe700dab559c62a89657f5ad8775c901dde27793280b
                                                  • Instruction Fuzzy Hash: A8F0F937A41AB276573526732C0DDBB1C2EEAD6F237070019FE40F5240DB4889418CF5
                                                  Function 005EA13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  • Failed to combine layout source with source., xrefs: 005EA2A4
                                                  • Failed to copy source path., xrefs: 005EA31A
                                                  • WixBundleOriginalSource, xrefs: 005EA1B7
                                                  • Failed to get current process directory., xrefs: 005EA1F3
                                                  • Failed to get bundle layout directory property., xrefs: 005EA287
                                                  • WixBundleLayoutDirectory, xrefs: 005EA26C
                                                  • Failed to combine last source with source., xrefs: 005EA210
                                                  • WixBundleLastUsedSource, xrefs: 005EA1A1
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Find$CloseFileFirstlstrlen
                                                  • String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
                                                  • API String ID: 2767606509-3003062821
                                                  • Opcode ID: b3bb71b8c263e5af37e18a397c7b75fdeea300cf42d722e8474388b67f6d85ca
                                                  • Instruction ID: ad6d76f67996a47fe0c60e994587c52ec9f09066a257644653b46b252be4414a
                                                  • Opcode Fuzzy Hash: b3bb71b8c263e5af37e18a397c7b75fdeea300cf42d722e8474388b67f6d85ca
                                                  • Instruction Fuzzy Hash: DE71B231D00259ABCF1ADFA9D845AEEBBB5BF48310F15052AF941B7250D731AD40CBA2
                                                  Function 005D3076 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 005D30C1
                                                  • GetLastError.KERNEL32 ref: 005D30C7
                                                  • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 005D3121
                                                  • GetLastError.KERNEL32 ref: 005D3127
                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005D31DB
                                                  • GetLastError.KERNEL32 ref: 005D31E5
                                                  • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 005D323B
                                                  • GetLastError.KERNEL32 ref: 005D3245
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
                                                  • String ID: pathutil.cpp
                                                  • API String ID: 1547313835-741606033
                                                  • Opcode ID: 84c0dc1298a7f77bf4bf13b87d0ce12174b78095eecb5fdd629d5607db12c8c3
                                                  • Instruction ID: 57941f359adbe93a07600f27edb55a673c3dbaf3cc91d909d38e18f76ccdc443
                                                  • Opcode Fuzzy Hash: 84c0dc1298a7f77bf4bf13b87d0ce12174b78095eecb5fdd629d5607db12c8c3
                                                  • Instruction Fuzzy Hash: 2C61B477D0022AABDB319AD88848B9EBF69BB04751F154167EE00BB350E7759F0097D2
                                                  Function 005E50CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetCurrentProcessId.KERNEL32(?,00000000,?,?,0061B500), ref: 005E50D3
                                                  • GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 005E5171
                                                  • CloseHandle.KERNEL32(00000000), ref: 005E518A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: Process$CloseCurrentHandle
                                                  • String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
                                                  • API String ID: 2815245435-1352204306
                                                  • Opcode ID: 3894b7d24f9a72eeca0ac4ad58a257b3f3dc4306b430117b9b4206f368f1afa2
                                                  • Instruction ID: 91ea0e9b5bf922fa50ebd01a2f271a4b3198cd2ad0de6a22623d2549abc64a57
                                                  • Opcode Fuzzy Hash: 3894b7d24f9a72eeca0ac4ad58a257b3f3dc4306b430117b9b4206f368f1afa2
                                                  • Instruction Fuzzy Hash: 8B216B71D00A19BF8F19EF95DC419AEBBBAFF08354B00816AF855A2211E7315F50DF90
                                                  Function 005D1175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D1186
                                                  • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D1191
                                                  • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005D119F
                                                  • GetLastError.KERNEL32(?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D11BA
                                                  • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005D11C2
                                                  • GetLastError.KERNEL32(?,?,?,?,?,005D111A,0061B460,00000009,?,?,00000000), ref: 005D11D7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: AddressErrorLastProc$HandleHeapInformationModule
                                                  • String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
                                                  • API String ID: 3104334766-1824683568
                                                  • Opcode ID: 4625c22a318ec0164e4b5c2ab28a93e6864de6542ff2d1d5ad7f038c50a24326
                                                  • Instruction ID: 7de5eddf1453c7dd345735a82bb77b434c49b9de53b25dd1db20627df3226581
                                                  • Opcode Fuzzy Hash: 4625c22a318ec0164e4b5c2ab28a93e6864de6542ff2d1d5ad7f038c50a24326
                                                  • Instruction Fuzzy Hash: 5D01B531200616BB97206FEA9C45EEF7F5EFB45791B096017F91592210E770DA41CBB4
                                                  Function 005E9098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,005E9F04,00000003,000007D0,00000003,?,000007D0), ref: 005E90B2
                                                  • GetLastError.KERNEL32(?,005E9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 005E90BF
                                                  • CloseHandle.KERNEL32(00000000,?,005E9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 005E9187
                                                  Strings
                                                  • Failed to verify hash of payload: %ls, xrefs: 005E9172
                                                  • Failed to verify catalog signature of payload: %ls, xrefs: 005E914E
                                                  • Failed to verify signature of payload: %ls, xrefs: 005E912F
                                                  • Failed to open payload at path: %ls, xrefs: 005E9103
                                                  • cache.cpp, xrefs: 005E90F6
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLast
                                                  • String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
                                                  • API String ID: 2528220319-2757871984
                                                  • Opcode ID: 8f227f2ca925210e5fea49cd72e6205e2e8d8afa5851a49a8d4a8d017df39e18
                                                  • Instruction ID: 6b2ac16351f60cbac3a652c52bd8aa3291147890ddec216642b90e0a8a88d3e9
                                                  • Opcode Fuzzy Hash: 8f227f2ca925210e5fea49cd72e6205e2e8d8afa5851a49a8d4a8d017df39e18
                                                  • Instruction Fuzzy Hash: F9213536500777B7CB3E2A668C4DFDE7E19BF447A0F114212FC806619093319C60EAD1
                                                  Function 005D71FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • lstrlenW.KERNEL32(00000000), ref: 005D7210
                                                  Strings
                                                  • Failed to append escape sequence., xrefs: 005D72A3
                                                  • Failed to allocate buffer for escaped string., xrefs: 005D7227
                                                  • Failed to copy string., xrefs: 005D72C4
                                                  • []{}, xrefs: 005D723A
                                                  • Failed to format escape sequence., xrefs: 005D72AA
                                                  • Failed to append characters., xrefs: 005D729C
                                                  • [\%c], xrefs: 005D726F
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: lstrlen
                                                  • String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
                                                  • API String ID: 1659193697-3250950999
                                                  • Opcode ID: e14fb9903f2d562dbc576d3728fe12a6c9276d8a598ffc190d5a630256f2dee9
                                                  • Instruction ID: b3422050bf8c451be5ad4d22f0568b714095011309b52f5228d7b677bf1289f1
                                                  • Opcode Fuzzy Hash: e14fb9903f2d562dbc576d3728fe12a6c9276d8a598ffc190d5a630256f2dee9
                                                  • Instruction Fuzzy Hash: 4A21D73A94965DBADB3196988C46BDE7F6ABF18731F250017F800B6350EB709E8192D4
                                                  Function 006141E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,0061432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,005EA063,00000001), ref: 00614203
                                                  • GetLastError.KERNEL32(00000002,?,0061432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,005EA063,00000001,000007D0,00000001,00000001,00000003), ref: 00614212
                                                  • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,0061432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,005EA063,00000001), ref: 006142A6
                                                  • GetLastError.KERNEL32(?,0061432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,005EA063,00000001,000007D0,00000001), ref: 006142B0
                                                    • Part of subcall function 00614440: FindFirstFileW.KERNEL32(005F923A,?,00000100,00000000,00000000), ref: 0061447B
                                                    • Part of subcall function 00614440: FindClose.KERNEL32(00000000), ref: 00614487
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorFindLastMove$CloseFirst
                                                  • String ID: \$fileutil.cpp
                                                  • API String ID: 3479031965-1689471480
                                                  • Opcode ID: ee7b480c842b19e506a7027eaeb42ee5b6b7797d84bb16bb2e1960415156874c
                                                  • Instruction ID: 21fe97f8e4ae32e75b2774f6413fc7a2f137a45257fbed01439f0395fda3a053
                                                  • Opcode Fuzzy Hash: ee7b480c842b19e506a7027eaeb42ee5b6b7797d84bb16bb2e1960415156874c
                                                  • Instruction Fuzzy Hash: EE31E536A02226ABDB215E99CC40AEF7667FF51761F1D802AFC049B310DB708EC1D6D0
                                                  Function 005DF005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,005E0654,00000001,00000001,00000001,005E0654,00000000), ref: 005DF07D
                                                  • RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,005E0654,00000001,00000001,00000001,005E0654,00000000,00000001,00000000,?,005E0654,00000001), ref: 005DF09A
                                                  Strings
                                                  • Failed to remove update registration key: %ls, xrefs: 005DF0C7
                                                  • Failed to format key for update registration., xrefs: 005DF033
                                                  • PackageVersion, xrefs: 005DF05E
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseCompareString
                                                  • String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
                                                  • API String ID: 446873843-3222553582
                                                  • Opcode ID: 9bce10c7dd80a39a43738b38f6175a18f90a8bf03efe2a9af900bfb566ab2fc3
                                                  • Instruction ID: b196c79c4eba28281128b99e3de3b56d50ba8a6b50dd6683a306225d9f79d029
                                                  • Opcode Fuzzy Hash: 9bce10c7dd80a39a43738b38f6175a18f90a8bf03efe2a9af900bfb566ab2fc3
                                                  • Instruction Fuzzy Hash: 5021B435D01129BADF31ABA9CC09FEEBEB9EF04720F144267BD16A7251E7714A40D790
                                                  Function 00614019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CopyFileW.KERNEL32(00000000,005D4DBC,00000000,?,?,00000000,?,0061412D,00000000,005D4DBC,00000000,00000000,?,005E85EE,?,?), ref: 00614033
                                                  • GetLastError.KERNEL32(?,0061412D,00000000,005D4DBC,00000000,00000000,?,005E85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00614041
                                                  • CopyFileW.KERNEL32(00000000,005D4DBC,00000000,005D4DBC,00000000,?,0061412D,00000000,005D4DBC,00000000,00000000,?,005E85EE,?,?,00000001), ref: 006140AC
                                                  • GetLastError.KERNEL32(?,0061412D,00000000,005D4DBC,00000000,00000000,?,005E85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 006140B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CopyErrorFileLast
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 374144340-2967768451
                                                  • Opcode ID: 277ec009a52ada3db9042d6a5975e572854cc97bcc89caef7919391417c8c439
                                                  • Instruction ID: 9573393f833f073c1ac7f8f6746595b4c9857b16c9a1be4215ded92606ef15af
                                                  • Opcode Fuzzy Hash: 277ec009a52ada3db9042d6a5975e572854cc97bcc89caef7919391417c8c439
                                                  • Instruction Fuzzy Hash: A421B62660233697DB300B974C44BFB669AEF18762B1D4136FF04DB251DF618CC092E5
                                                  Function 00614153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                    • Part of subcall function 00614440: FindFirstFileW.KERNEL32(005F923A,?,00000100,00000000,00000000), ref: 0061447B
                                                    • Part of subcall function 00614440: FindClose.KERNEL32(00000000), ref: 00614487
                                                  • SetFileAttributesW.KERNEL32(005F923A,00000080,00000000,005F923A,000000FF,00000000,?,?,005F923A), ref: 00614182
                                                  • GetLastError.KERNEL32(?,?,005F923A), ref: 0061418C
                                                  • DeleteFileW.KERNEL32(005F923A,00000000,005F923A,000000FF,00000000,?,?,005F923A), ref: 006141AC
                                                  • GetLastError.KERNEL32(?,?,005F923A), ref: 006141B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
                                                  • String ID: fileutil.cpp
                                                  • API String ID: 3967264933-2967768451
                                                  • Opcode ID: a420e011c43b698c2ba7bfa36bb27e3c0b7741bbfeda2a65cf4b2c27f3c72588
                                                  • Instruction ID: 19d1c48fcfffafc9fb0959df51dcbb93d5d8f5b2ed624d35412f1ac8877e6e58
                                                  • Opcode Fuzzy Hash: a420e011c43b698c2ba7bfa36bb27e3c0b7741bbfeda2a65cf4b2c27f3c72588
                                                  • Instruction Fuzzy Hash: A701F972A41635B7D7314AA5CC0ABFB7E9AAF14761F1A4215FD44E72D0DB218DC085D0
                                                  Function 005D61DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastNameUser
                                                  • String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
                                                  • API String ID: 2054405381-1522884404
                                                  • Opcode ID: 90602e1c355a0ea1087fb9c739be59c0b7a6517ed85e0481f9276256571b9aec
                                                  • Instruction ID: 2de0028472aa8edd8e80ff9487e2f918729a2a80caea049cfb9f5ae7663112bb
                                                  • Opcode Fuzzy Hash: 90602e1c355a0ea1087fb9c739be59c0b7a6517ed85e0481f9276256571b9aec
                                                  • Instruction Fuzzy Hash: F101D636A4122967C730DB989C0AAEF7BA9BB14720F05025BFC04E7341DA749E419AD5
                                                  Function 005FD152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • CloseHandle.KERNEL32(?,00000000,?,00000000,?,005FD148,00000000), ref: 005FD16D
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,005FD148,00000000), ref: 005FD179
                                                  • CloseHandle.KERNEL32(0061B518,00000000,?,00000000,?,005FD148,00000000), ref: 005FD186
                                                  • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,005FD148,00000000), ref: 005FD193
                                                  • UnmapViewOfFile.KERNEL32(0061B4E8,00000000,?,005FD148,00000000), ref: 005FD1A2
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$FileUnmapView
                                                  • String ID:
                                                  • API String ID: 260491571-0
                                                  • Opcode ID: 08f589944e6baa4e659fdc9e3d0eedd6ee833a37c8b1c8ea5fdd5a2976515336
                                                  • Instruction ID: 11d657a42a3a5a6fdd6cbc285b335241458b2c7e4b071977f6b27ac88a150d3e
                                                  • Opcode Fuzzy Hash: 08f589944e6baa4e659fdc9e3d0eedd6ee833a37c8b1c8ea5fdd5a2976515336
                                                  • Instruction Fuzzy Hash: 0301E472501B1ADFCB31AF66D880826FBFABF50711315D93EE2A652920C375A880CF60
                                                  Function 006131EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • SysAllocString.OLEAUT32(?), ref: 00613200
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00613230
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: String$AllocFree
                                                  • String ID: `Dv$xmlutil.cpp
                                                  • API String ID: 344208780-2876128059
                                                  • Opcode ID: b0ac239cd260efc8585ac68982648ecf678be16fa8d24de87d53df11d7e7ca58
                                                  • Instruction ID: 03a77b69f62ba83908882949a8d266552d5d904ee618f073fe5a6b2078e3dc3f
                                                  • Opcode Fuzzy Hash: b0ac239cd260efc8585ac68982648ecf678be16fa8d24de87d53df11d7e7ca58
                                                  • Instruction Fuzzy Hash: 6DF0E935101664E7C731AF849C08FEB77ABAF84B60F19802AFC0657310C7748F5196D0
                                                  Function 00616067 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(?,?,00615FD0,00000000,00000000,00000001), ref: 006160DF
                                                  • GetLastError.KERNEL32(?,?,00615FD0,00000000,00000000,00000001), ref: 00616130
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast
                                                  • String ID: 8jc$dlutil.cpp
                                                  • API String ID: 1452528299-2359427462
                                                  • Opcode ID: ff773b6ef7a7e65d8899526a1c85cd894c96dccf692294402ec0da6429e2b9bf
                                                  • Instruction ID: 8952bba6bc7b187ce9afe4a71ec768ec272d175ccd893582008107e7d5073959
                                                  • Opcode Fuzzy Hash: ff773b6ef7a7e65d8899526a1c85cd894c96dccf692294402ec0da6429e2b9bf
                                                  • Instruction Fuzzy Hash: 0131E63A900626B7C7224A99CD49BDB7A7AAF40751F1A4155FD00A7351D670CD40D6E0
                                                  Function 0060615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                  Download Yara Rule
                                                  APIs
                                                  • GetLastError.KERNEL32(?,00000000,00601AEC,00000000,80004004,?,00601DF0,00000000,80004004,00000000,00000000), ref: 00606162
                                                  • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006061CA
                                                  • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006061D6
                                                  • _abort.LIBCMT ref: 006061DC
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$_abort
                                                  • String ID:
                                                  • API String ID: 88804580-0
                                                  • Opcode ID: 7386a9e34bb0aac96bfc53d2a63baba836f1c1e7ae4a6230289fbe735b81b5ec
                                                  • Instruction ID: 8427e384361698cc0dafc05fdd0d2fd39e0ab4339f73ccc9ab636e99a9570128
                                                  • Opcode Fuzzy Hash: 7386a9e34bb0aac96bfc53d2a63baba836f1c1e7ae4a6230289fbe735b81b5ec
                                                  • Instruction Fuzzy Hash: A6F078352C4A01ABC31E333DAC0EBAF165B8FC1371F26105DF816922D3FF6088020468
                                                  Function 006110B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0061112B
                                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00611163
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.2190125736.00000000005D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005D0000, based on PE: true
                                                  • Associated: 00000002.00000002.2190100695.00000000005D0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190160162.000000000061B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190186900.000000000063A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.2190203413.000000000063D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_5d0000_8Rmoal0v85.jbxd
                                                  Similarity
                                                  • API ID: QueryValue
                                                  • String ID: regutil.cpp
                                                  • API String ID: 3660427363-955085611
                                                  • Opcode ID: ac2ff79f585f8197ce7c4113f01e8368af30c1b757ad320b319fe87275906805
                                                  • Instruction ID: e8bc1f3df7a214e81cde95ed6a7ba00bebee03e1086ce41c9f1c29654b2760a8
                                                  • Opcode Fuzzy Hash: ac2ff79f585f8197ce7c4113f01e8368af30c1b757ad320b319fe87275906805
                                                  • Instruction Fuzzy Hash: 47418372D0012BBBDB209E94CC469EEFBBBFF45350F18416AEB10AB250D7718D919790