Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
8Rmoal0v85.exe

Overview

General Information

Sample name:8Rmoal0v85.exe
renamed because original name is a hash value
Original sample name:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20.exe
Analysis ID:1586710
MD5:9c4e46ef2e0ad08e7040de7b3c1e60e7
SHA1:72d4a6613e520cb8b39e1ac4b347270cc1450fff
SHA256:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20
Tags:exeuser-crep1x
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

  • System is w10x64
  • 8Rmoal0v85.exe (PID: 6708 cmdline: "C:\Users\user\Desktop\8Rmoal0v85.exe" MD5: 9C4E46EF2E0AD08E7040DE7B3C1E60E7)
    • 8Rmoal0v85.exe (PID: 2104 cmdline: "C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=640 -burn.filehandle.self=680 MD5: 9C540950F5A8981844FF33BFC55D2F36)
      • AdobeSync.exe (PID: 5392 cmdline: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
        • AdobeSync.exe (PID: 2736 cmdline: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
          • cmd.exe (PID: 5260 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 3544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • LocalCtrl_alpha_v3.exe (PID: 5916 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • AdobeSync.exe (PID: 1924 cmdline: "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe" MD5: F778E9136AB0DB9DE9802A7043DE50A7)
    • cmd.exe (PID: 6880 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • LocalCtrl_alpha_v3.exe (PID: 4044 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\skfbgbpiyswReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\towcnReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeReversingLabs: Detection: 44%
Multi AV Scanner detection for submitted file
Source: 8Rmoal0v85.exeReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\towcnJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\skfbgbpiyswJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DDA0BB DecryptFileW,0_2_00DDA0BB
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFFA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,0_2_00DFFA62
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DD9E9E DecryptFileW,DecryptFileW,0_2_00DD9E9E
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0090A0BB DecryptFileW,2_2_0090A0BB
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,2_2_0092FA62
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00909E9E DecryptFileW,DecryptFileW,2_2_00909E9E
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_00690070 CryptUnprotectData,_CxxThrowException,3_2_00690070
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006900D0 CryptProtectData,_CxxThrowException,3_2_006900D0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009C00D0 CryptProtectData,_CxxThrowException,4_2_009C00D0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009C0070 CryptUnprotectData,_CxxThrowException,4_2_009C0070
Source: 8Rmoal0v85.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dllJump to behavior
Source: 8Rmoal0v85.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 8Rmoal0v85.exe, 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2148530472.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2153051393.000000000093B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 8Rmoal0v85.exe, 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766348188.0000000004BD7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766845229.00000000051DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773933344.0000000006DD1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771774283.0000000005DDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772745558.00000000063DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774405653.00000000071D3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772428052.00000000061DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3768710136.00000000059DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773452049.00000000069D6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767068774.00000000053DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773726943.0000000006BD4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766650669.0000000004FD2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767738029.00000000057DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763283528.0000000002304000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765012638.00000000041D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771463658.0000000005BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765637567.00000000045D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764540426.0000000003BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765166334.00000000043DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766497353.0000000004DD0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766046464.00000000047D9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764854358.0000000003FD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772065192.0000000005FDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766198640.00000000049D0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774162778.0000000006FD8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767320608.00000000055DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764700780.0000000003DDA000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2182069977.000000000A400000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2181696804.000000000A0A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2241182680.000000000A833000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240720925.000000000A12A000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240920946.000000000A480000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2525941386.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526477270.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606529912.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2607033207.000000000A252000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606683533.0000000009EA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832695264.000000000529F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2833410250.0000000005B70000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766348188.0000000004BD7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766845229.00000000051DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773933344.0000000006DD1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771774283.0000000005DDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772745558.00000000063DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774405653.00000000071D3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772428052.00000000061DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3768710136.00000000059DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773452049.00000000069D6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767068774.00000000053DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773726943.0000000006BD4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766650669.0000000004FD2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767738029.00000000057DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763283528.0000000002304000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765012638.00000000041D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771463658.0000000005BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765637567.00000000045D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764540426.0000000003BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765166334.00000000043DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766497353.0000000004DD0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766046464.00000000047D9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764854358.0000000003FD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772065192.0000000005FDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766198640.00000000049D0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774162778.0000000006FD8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767320608.00000000055DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764700780.0000000003DDA0
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2182069977.000000000A400000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2181696804.000000000A0A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2241182680.000000000A833000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240720925.000000000A12A000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240920946.000000000A480000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2525941386.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526477270.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606529912.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2607033207.000000000A252000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606683533.0000000009EA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832695264.000000000529F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2833410250.0000000005B70000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 8Rmoal0v85.exe, 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000003.2173577252.0000000001170000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182325743.000000006CF51000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000004.00000002.2242736686.000000006CA31000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000D.00000002.2607838490.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2158263303.00000000006CD000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2173250232.0000000001197000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176561855.00000000006CD000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000000.2176115608.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000002.2236688754.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000D.00000002.2599731433.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000D.00000000.2539146750.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.2182883792.000000006CFC0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2242848097.000000006CA60000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000D.00000002.2607939934.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000003.2173577252.0000000001170000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182325743.000000006CF51000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000004.00000002.2242736686.000000006CA31000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000D.00000002.2607838490.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.2182883792.000000006CFC0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2242848097.000000006CA60000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000D.00000002.2607939934.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00DC3CC4
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E04440 FindFirstFileW,FindClose,0_2_00E04440
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF7B87 FindFirstFileExW,0_2_00DF7B87
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DD9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,0_2_00DD9B43
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00934440 FindFirstFileW,FindClose,2_2_00934440
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00927B87 FindFirstFileExW,2_2_00927B87
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00909B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_00909B43
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_008F3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_008F3CC4
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6CFDDCB0
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFEDB36 FindFirstFileExW,2_2_6CFEDB36
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_0064CE10 FindFirstFileW,3_2_0064CE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0097CE10 FindFirstFileW,4_2_0097CE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0097BB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_0097BB70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0098FD50 free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,FindFirstFileA,FindClose,free,free,free,free,free,free,free,free,4_2_0098FD50
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: unknownDNS traffic detected: query: tataragirld.site replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_00644970 HttpSendRequestA,printf,_CxxThrowException,HttpSendRequestA,InternetReadFile,_CxxThrowException,HttpEndRequestA,3_2_00644970
Source: global trafficDNS traffic detected: DNS query: tataragirld.site
Source: 8Rmoal0v85.exeString found in binary or memory: http://appsyndication.org/2006/appsyn
Source: 8Rmoal0v85.exe, 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2148530472.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2153051393.000000000093B000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.???.xx/?search=%s
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AdobeSync.exe, 00000003.00000002.2181217677.000000000837D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008402000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.000000000584A000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.0000000002705000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.00000000055FE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.surfok.de/
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/.
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.3892824225.0000000000530000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3169612982.0000000000530000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2BgLgGV
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_seasonO
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_seasonP
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3762941318.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/7
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/;
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/N
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/R
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/V
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/_
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/b
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/n
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/~
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3984382974.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3802186945.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3440475873.000000000055E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:44336
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443G
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.3802186945.000000000055E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443Um
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443l
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443q
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile deleted: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF001D0_2_00DF001D
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DE41EA0_2_00DE41EA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC62AA0_2_00DC62AA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF03D50_2_00DF03D5
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEC3320_2_00DEC332
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFA5600_2_00DFA560
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF07AA0_2_00DF07AA
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DCA8F10_2_00DCA8F1
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFAA0E0_2_00DFAA0E
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEFB890_2_00DEFB89
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF0B6F0_2_00DF0B6F
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF2C180_2_00DF2C18
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF2E470_2_00DF2E47
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFEE7C0_2_00DFEE7C
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092001D2_2_0092001D
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_009141EA2_2_009141EA
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_008F62AA2_2_008F62AA
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_009203D52_2_009203D5
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091C3322_2_0091C332
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092A5602_2_0092A560
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_009207AA2_2_009207AA
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_008FA8F12_2_008FA8F1
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092AA0E2_2_0092AA0E
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091FB892_2_0091FB89
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00920B6F2_2_00920B6F
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00922C182_2_00922C18
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00922E472_2_00922E47
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092EE7C2_2_0092EE7C
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD4EA02_2_6CFD4EA0
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFEBF892_2_6CFEBF89
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFF2F422_2_6CFF2F42
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE64E02_2_6CFE64E0
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD35702_2_6CFD3570
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFF30622_2_6CFF3062
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE21B02_2_6CFE21B0
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE52552_2_6CFE5255
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFEF3DF2_2_6CFEF3DF
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFEB3DB2_2_6CFEB3DB
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006945003_2_00694500
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006949A03_2_006949A0
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006953A03_2_006953A0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009976104_2_00997610
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 005F5A10 appears 77 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 006B7696 appears 112 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 00648490 appears 493 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 005F6970 appears 34 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 00695F10 appears 76 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 006559E0 appears 32 times
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: String function: 00614080 appears 36 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00E00726 appears 34 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00DC1F13 appears 54 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00E00237 appears 683 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00DC3821 appears 501 times
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: String function: 00E032F3 appears 83 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 6CFE0F70 appears 47 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 009332F3 appears 83 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 00930726 appears 34 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 00930237 appears 683 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 008F3821 appears 501 times
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: String function: 008F1F13 appears 54 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 009859E0 appears 51 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00921013 appears 40 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 009C5F10 appears 66 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00926970 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00978490 appears 646 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00944080 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 009E8A9E appears 32 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00925A10 appears 94 times
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
Source: skfbgbpiysw.14.drStatic PE information: Number of sections : 12 > 10
Source: towcn.5.drStatic PE information: Number of sections : 12 > 10
Source: 8Rmoal0v85.exe, 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000000.2153169384.000000000095D000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite.dllX vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exe, 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenameSharePoint.dllF vs 8Rmoal0v85.exe
Source: 8Rmoal0v85.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: classification engineClassification label: mal84.evad.winEXE@18/26@13/0
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFFE21 FormatMessageW,GetLastError,LocalFree,0_2_00DFFE21
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,0_2_00DC45EE
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_008F45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,2_2_008F45EE
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E0304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,0_2_00E0304F
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFD7F40 LoadResource,LockResource,SizeofResource,2_2_6CFD7F40
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DE6B88 ChangeServiceConfigW,GetLastError,0_2_00DE6B88
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCFJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3544:120:WilError_03
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\Jump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: cabinet.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: msi.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: version.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: wininet.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: comres.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: clbcatq.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: msasn1.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: crypt32.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: feclient.dll0_2_00DC1070
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCommand line argument: cabinet.dll0_2_00DC1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: cabinet.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: msi.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: version.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: wininet.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: comres.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: clbcatq.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: msasn1.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: crypt32.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: feclient.dll2_2_008F1070
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCommand line argument: cabinet.dll2_2_008F1070
Source: 8Rmoal0v85.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 8Rmoal0v85.exe, 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: SELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmp;.\\?\\\?\UNC\\\invalid string position\ *AI_WSP_LISTAI_WSP_FEATURES_LIST[AI_WSP_URL]AI_SHAREPOINT_LOGAI_GLOBAL_WSPAI_LOCAL_WSPAI_NOT_VITAL_WSPAI_DEPLOY_WSP_CADATAAI_DEPLOY_WSP_CADATA_64AI_SHAREPOINT_STRINGS,|$^.cab.wspSharePoint.log-url [AI_WSP_URL] -allcontenturls-immediate-time-local-allowgacdeployment-allowcaspolicies-force-idSPAdminSPAdminV4SPTimerV3SPTimerV4
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 8Rmoal0v85.exe, 00000002.00000003.2157493601.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176856576.0000000001154000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182762777.000000006CF93000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2242636921.000000006CA13000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000D.00000002.2607745290.000000006FD23000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 8Rmoal0v85.exeReversingLabs: Detection: 42%
Source: 8Rmoal0v85.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: 8Rmoal0v85.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile read: C:\Users\user\Desktop\8Rmoal0v85.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\8Rmoal0v85.exe "C:\Users\user\Desktop\8Rmoal0v85.exe"
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=640 -burn.filehandle.self=680
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: unknownProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=640 -burn.filehandle.self=680 Jump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: pqclclekwl.5.drLNK file: ..\..\Roaming\PatchReaderWCF\AdobeSync.exe
Source: 8Rmoal0v85.exeStatic file information: File size 7012352 > 1048576
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dllJump to behavior
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 8Rmoal0v85.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 8Rmoal0v85.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 8Rmoal0v85.exe, 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2148530472.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2153051393.000000000093B000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 8Rmoal0v85.exe, 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766348188.0000000004BD7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766845229.00000000051DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773933344.0000000006DD1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771774283.0000000005DDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772745558.00000000063DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774405653.00000000071D3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772428052.00000000061DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3768710136.00000000059DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773452049.00000000069D6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767068774.00000000053DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773726943.0000000006BD4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766650669.0000000004FD2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767738029.00000000057DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763283528.0000000002304000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765012638.00000000041D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771463658.0000000005BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765637567.00000000045D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764540426.0000000003BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765166334.00000000043DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766497353.0000000004DD0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766046464.00000000047D9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764854358.0000000003FD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772065192.0000000005FDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766198640.00000000049D0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774162778.0000000006FD8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767320608.00000000055DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764700780.0000000003DDA000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2182069977.000000000A400000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2181696804.000000000A0A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2241182680.000000000A833000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240720925.000000000A12A000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240920946.000000000A480000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2525941386.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526477270.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606529912.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2607033207.000000000A252000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606683533.0000000009EA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832695264.000000000529F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2833410250.0000000005B70000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766348188.0000000004BD7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766845229.00000000051DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773933344.0000000006DD1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771774283.0000000005DDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772745558.00000000063DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774405653.00000000071D3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772428052.00000000061DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3768710136.00000000059DC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773452049.00000000069D6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767068774.00000000053DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3773726943.0000000006BD4000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766650669.0000000004FD2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767738029.00000000057DE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763283528.0000000002304000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765012638.00000000041D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3771463658.0000000005BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765637567.00000000045D5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764540426.0000000003BD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3765166334.00000000043DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766497353.0000000004DD0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766046464.00000000047D9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764854358.0000000003FD5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3772065192.0000000005FDB000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3766198640.00000000049D0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3774162778.0000000006FD8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3767320608.00000000055DD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3764700780.0000000003DDA0
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2182069977.000000000A400000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2181696804.000000000A0A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2241182680.000000000A833000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240720925.000000000A12A000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240920946.000000000A480000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2525941386.00000000054E2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526477270.0000000005DC0000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606529912.0000000009B49000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2607033207.000000000A252000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606683533.0000000009EA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832695264.000000000529F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2833410250.0000000005B70000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 8Rmoal0v85.exe, 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000003.2173577252.0000000001170000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182325743.000000006CF51000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000004.00000002.2242736686.000000006CA31000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000D.00000002.2607838490.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2158263303.00000000006CD000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2173250232.0000000001197000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2176561855.00000000006CD000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000000.2176115608.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000002.2236688754.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000D.00000002.2599731433.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000D.00000000.2539146750.00000000009FD000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.2182883792.000000006CFC0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2242848097.000000006CA60000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000D.00000002.2607939934.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000003.2173577252.0000000001170000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2182325743.000000006CF51000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000004.00000002.2242736686.000000006CA31000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000D.00000002.2607838490.000000006FD41000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.2182883792.000000006CFC0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.2242848097.000000006CA60000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000D.00000002.2607939934.000000006FD70000.00000002.00000001.01000000.0000000E.sdmp
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 8Rmoal0v85.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: Quadruple.dll.2.drStatic PE information: real checksum: 0x4dc7e should be: 0x4a7b1
Source: 8Rmoal0v85.exeStatic PE information: real checksum: 0x0 should be: 0x6bfb22
Source: skfbgbpiysw.14.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: 8Rmoal0v85.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x60e0b6
Source: towcn.5.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: AXE8SharedExpat.dll.3.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: AXE8SharedExpat.dll.2.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: 8Rmoal0v85.exeStatic PE information: section name: .wixburn
Source: 8Rmoal0v85.exe.0.drStatic PE information: section name: .wixburn
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: section name: Shared
Source: towcn.5.drStatic PE information: section name: .xdata
Source: towcn.5.drStatic PE information: section name: ubpux
Source: skfbgbpiysw.14.drStatic PE information: section name: .xdata
Source: skfbgbpiysw.14.drStatic PE information: section name: ubpux
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEEAD6 push ecx; ret 0_2_00DEEAE9
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091EAD6 push ecx; ret 2_2_0091EAE9
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE0FB4 push ecx; ret 2_2_6CFE0FC6
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006B8249 push ecx; ret 3_2_006B825C
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006B8B07 push ecx; ret 3_2_006B8B1A
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E8249 push ecx; ret 4_2_009E825C
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E8B07 push ecx; ret 4_2_009E8B1A
Source: msvcr90.dll.2.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.3.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\towcnJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\skfbgbpiyswJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dllJump to dropped file
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dllJump to dropped file
Source: C:\Users\user\Desktop\8Rmoal0v85.exeFile created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeFile created: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\towcnJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\skfbgbpiyswJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\TOWCN
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\SKFBGBPIYSW
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDFBC5 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_6CFDFBC5

Malware Analysis System Evasion

barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CAF7C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CAF7C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CAF7945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CAF3B54
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6D157C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6D157945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6D153B54
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\towcnJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\skfbgbpiyswJump to dropped file
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeDropped PE file which has not been started: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeEvaded block: after key decision
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeEvaded block: after key decision
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeAPI coverage: 9.7 %
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe TID: 5912Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6512Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6512Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6440Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6440Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00DFFF61h0_2_00DFFEC6
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DFFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00DFFF5Ah0_2_00DFFEC6
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0092FF61h2_2_0092FEC6
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0092FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0092FF5Ah2_2_0092FEC6
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,0_2_00DC3CC4
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E04440 FindFirstFileW,FindClose,0_2_00E04440
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF7B87 FindFirstFileExW,0_2_00DF7B87
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DD9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,0_2_00DD9B43
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00934440 FindFirstFileW,FindClose,2_2_00934440
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00927B87 FindFirstFileExW,2_2_00927B87
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00909B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_00909B43
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_008F3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_008F3CC4
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFDDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6CFDDCB0
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFEDB36 FindFirstFileExW,2_2_6CFEDB36
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_0064CE10 FindFirstFileW,3_2_0064CE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0097CE10 FindFirstFileW,4_2_0097CE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0097BB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_0097BB70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_0098FD50 free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,free,FindFirstFileA,FindClose,free,free,free,free,free,free,free,free,4_2_0098FD50
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E097A5 VirtualQuery,GetSystemInfo,0_2_00E097A5
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeThread delayed: delay time: 30000Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
Source: LocalCtrl_alpha_v3.exe, 0000000C.00000002.3762941318.00000000004FC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\8Rmoal0v85.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DEE88A
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_005F1412 OutputDebugStringA,GetLastError,3_2_005F1412
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF48D8 mov eax, dword ptr fs:[00000030h]0_2_00DF48D8
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_009248D8 mov eax, dword ptr fs:[00000030h]2_2_009248D8
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFED82F mov eax, dword ptr fs:[00000030h]2_2_6CFED82F
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE72E9 mov eax, dword ptr fs:[00000030h]2_2_6CFE72E9
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC394F GetProcessHeap,RtlAllocateHeap,0_2_00DC394F
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00DEE3D8
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DEE88A
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEE9DC SetUnhandledExceptionFilter,0_2_00DEE9DC
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DF3C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00DF3C76
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_0091E3D8
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0091E88A
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_0091E9DC SetUnhandledExceptionFilter,2_2_0091E9DC
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_00923C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00923C76
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE0C6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6CFE0C6C
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE3EDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6CFE3EDE
Source: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exeCode function: 2_2_6CFE03FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_6CFE03FB
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeCode function: 3_2_006B82A6 SetUnhandledExceptionFilter,3_2_006B82A6
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E762E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,4_2_009E762E

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF610E6F270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6BD5979D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6BD421CB2Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x6FD52240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6BD44A7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x14011D93EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD476678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF610E8AAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF610FD54D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF610FD325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610FD6770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF610E86EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610DDFD88Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF610E6FBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF6BD4497BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD39B119Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6BD5979E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationThread: Direct from: 0x7FF6BD5A09E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD428D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610E54E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6BD4A0DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x14011D808Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD393E52Jump to behavior
Source: C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exeNtProtectVirtualMemory: Direct from: 0x77377B2EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6BD393FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD42A90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6BD42F369Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF610FD54B3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610E5DD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6BD5954B3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610E6D226Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD479090Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6BD3941F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6BD596342Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610E6838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF6BD592F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD42838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610FE299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF610FD2F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6BD414EF6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6BD449DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610E54EF6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF610DD41F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF610E68C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF610DD3FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD596770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610FE09E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6BD428C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6BD5A299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF610EB6678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610DD12F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6BD59325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF610EE0DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6BD5954D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610DD3E52Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF610E89DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6BD42FBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF610FD79D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6BD44AAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FFDB4404B5EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6BD41DD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF610FD79E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610E6A90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6BD414E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610E68D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF610E6F369Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD39C6DDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6BD42F270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610FD6342Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtQuerySystemInformation: Direct from: 0x773763E1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6BD41D940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610DDB119Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF610FE2A76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF610E8A7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF610E5D940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610EB9090Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF610E67F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6BD449EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF610DD991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD446EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x14011D832Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF610E68D66Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF610E6F9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FFDB43E26A1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6BD42F9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF610E897BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF610E702F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6BD4302F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD427F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x14011D7A4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD39991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF610FD79C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6BD5979C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF6BD428D66Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF610E89EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x140120A3CJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF610E61CB2Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x6CA42240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6BD39FD88Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 262010Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 275010Jump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeProcess created: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe "C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=640 -burn.filehandle.self=680 Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E01719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,0_2_00E01719
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E03A5F AllocateAndInitializeSid,CheckTokenMembership,0_2_00E03A5F
Source: AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DEEC07 cpuid 0_2_00DEEC07
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DD4EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,0_2_00DD4EDF
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC6037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,0_2_00DC6037
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC61DF GetUserNameW,GetLastError,0_2_00DC61DF
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00E0887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,0_2_00E0887B
Source: C:\Users\user\Desktop\8Rmoal0v85.exeCode function: 0_2_00DC5195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,0_2_00DC5195
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3BC0 sqlite3_bind_parameter_count,4_2_009E3BC0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3BE0 sqlite3_bind_int,4_2_009E3BE0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3CA0 sqlite3_bind_text,4_2_009E3CA0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3C10 sqlite3_bind_int,4_2_009E3C10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3C40 sqlite3_bind_int64,4_2_009E3C40
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3C70 sqlite3_bind_double,4_2_009E3C70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3DC0 sqlite3_bind_blob,4_2_009E3DC0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_009E3E10 sqlite3_bind_null,4_2_009E3E10

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Native API		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		OS Credential Dumping12
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts3
Command and Scripting Interpreter		1
Windows Service		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		LSASS Memory1
Account Discovery		Remote Desktop ProtocolData from Removable Media2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		Logon Script (Windows)1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Windows Service		1
Software Packing		NTDS135
System Information Discovery		Distributed Component Object ModelInput Capture1
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script213
Process Injection		11
DLL Side-Loading		LSA Secrets231
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
File Deletion		Cached Domain Credentials2
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Masquerading		DCSync11
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Virtualization/Sandbox Evasion		Proc Filesystem1
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron213
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1586710 Sample: 8Rmoal0v85.exe Startdate: 09/01/2025 Architecture: WINDOWS Score: 84 67 tataragirld.site 2->67 75 Multi AV Scanner detection for dropped file 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 Machine Learning detection for dropped file 2->79 81 AI detected suspicious sample 2->81 11 8Rmoal0v85.exe 3 2->11         started        14 AdobeSync.exe 1 2->14         started        signatures3 process4 file5 65 C:\Windows\Temp\...\8Rmoal0v85.exe, PE32 11->65 dropped 17 8Rmoal0v85.exe 15 11->17         started        97 Maps a DLL or memory area into another process 14->97 99 Found direct / indirect Syscall (likely to bypass EDR) 14->99 21 cmd.exe 2 14->21         started        signatures6 process7 file8 43 C:\Windows\Temp\...\sqlite.dll, PE32 17->43 dropped 45 C:\Windows\Temp\...\Quadruple.dll, PE32 17->45 dropped 47 C:\Windows\Temp\...\BIB.dll, PE32 17->47 dropped 51 4 other files (2 malicious) 17->51 dropped 69 Multi AV Scanner detection for dropped file 17->69 23 AdobeSync.exe 9 17->23         started        49 C:\Users\user\AppData\Local\...\skfbgbpiysw, PE32+ 21->49 dropped 71 Writes to foreign memory regions 21->71 73 Maps a DLL or memory area into another process 21->73 27 LocalCtrl_alpha_v3.exe 21->27         started        29 conhost.exe 21->29         started        signatures9 process10 file11 57 C:\Users\user\AppData\Roaming\...\sqlite.dll, PE32 23->57 dropped 59 C:\Users\user\AppData\Roaming\...\BIB.dll, PE32 23->59 dropped 61 C:\Users\user\AppData\...\AdobeSync.exe, PE32 23->61 dropped 63 3 other files (1 malicious) 23->63 dropped 93 Switches to a custom stack to bypass stack traces 23->93 95 Found direct / indirect Syscall (likely to bypass EDR) 23->95 31 AdobeSync.exe 1 23->31         started        signatures12 process13 signatures14 101 Maps a DLL or memory area into another process 31->101 103 Switches to a custom stack to bypass stack traces 31->103 105 Found direct / indirect Syscall (likely to bypass EDR) 31->105 34 cmd.exe 5 31->34         started        process15 file16 53 C:\Users\user\AppData\Local\Temp\towcn, PE32+ 34->53 dropped 55 C:\Users\user\...\LocalCtrl_alpha_v3.exe, PE32+ 34->55 dropped 83 Writes to foreign memory regions 34->83 85 Found hidden mapped module (file has been removed from disk) 34->85 87 Maps a DLL or memory area into another process 34->87 89 Switches to a custom stack to bypass stack traces 34->89 38 LocalCtrl_alpha_v3.exe 34->38         started        41 conhost.exe 34->41         started        signatures17 process18 signatures19 91 Found direct / indirect Syscall (likely to bypass EDR) 38->91

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
8Rmoal0v85.exe42%ReversingLabsWin32.Trojan.Rugmi

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\towcn100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\skfbgbpiysw100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\skfbgbpiysw24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Local\Temp\towcn24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\BIB.dll0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\Quadruple.dll0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcp90.dll0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dll0%ReversingLabs
C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\sqlite.dll0%ReversingLabs
C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe45%ReversingLabsWin32.Trojan.Rugmi

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://tataragirld.site/R0%Avira URL Cloudsafe
http://www.softwareok.de/?Download=Find.Same.Images.OK0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_seasonO0%Avira URL Cloudsafe
https://tataragirld.site/b0%Avira URL Cloudsafe
https://tataragirld.site/_0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_seasonP0%Avira URL Cloudsafe
https://tataragirld.site/N0%Avira URL Cloudsafe
https://tataragirld.site:443G0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK0%Avira URL Cloudsafe
https://tataragirld.site/V0%Avira URL Cloudsafe
https://tataragirld.site/~0%Avira URL Cloudsafe
https://tataragirld.site/;0%Avira URL Cloudsafe
https://tataragirld.site:443q0%Avira URL Cloudsafe
https://tataragirld.site/0%Avira URL Cloudsafe
https://tataragirld.site:443Um0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History0%Avira URL Cloudsafe
https://tataragirld.site/.0%Avira URL Cloudsafe
https://tataragirld.site:443360%Avira URL Cloudsafe
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=00%Avira URL Cloudsafe
https://tataragirld.site:443l0%Avira URL Cloudsafe
https://tataragirld.site:4430%Avira URL Cloudsafe
https://tataragirld.site/70%Avira URL Cloudsafe
https://tataragirld.site/20%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_season0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
tataragirld.site
unknown
unknownfalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.vmware.com/0AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      http://www.softwareok.com/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
        		high
        https://tataragirld.site/_LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://www.softwareok.com/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
          		high
          http://www.softwareok.de/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/bLocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site:443GLocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.vmware.com/0/AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
              		high
              https://tataragirld.site/2009_New_England_Patriots_seasonOLocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://tataragirld.site/2009_New_England_Patriots_seasonPLocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor8Rmoal0v85.exe, 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000000.00000000.2148530472.0000000000E0B000.00000002.00000001.01000000.00000003.sdmp, 8Rmoal0v85.exe, 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmp, 8Rmoal0v85.exe, 00000002.00000000.2153051393.000000000093B000.00000002.00000001.01000000.00000005.sdmpfalse
                		high
                http://www.???.xx/?search=%sAdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpfalse
                  		high
                  https://tataragirld.site/NLocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.symauth.com/cps0(AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    https://tataragirld.site/RLocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://tataragirld.site/VLocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.softwareok.de/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://tataragirld.site/LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://tataragirld.site/;LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://tataragirld.site:443UmLocalCtrl_alpha_v3.exe, 00000010.00000003.3802186945.000000000055E000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://tataragirld.site/~LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.symauth.com/rpa00AdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      https://tataragirld.site:443qLocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.2952590535.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.deAdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpfalse
                        		high
                        http://www.info-zip.org/AdobeSync.exe, 00000003.00000002.2181217677.000000000837D000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008402000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.000000000584A000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.0000000002705000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E23000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.00000000055FE000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.softwareok.de/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://tataragirld.site:44336LocalCtrl_alpha_v3.exe, 0000000C.00000003.3405008448.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3224012600.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3314491955.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.softwareok.com/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401F4000.00000002.00000001.01000000.00000015.sdmpfalse
                            		high
                            https://tataragirld.site/.LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://tataragirld.site/nLocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              https://tataragirld.site:443lLocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3495456113.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.surfok.de/LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://tataragirld.site:443LocalCtrl_alpha_v3.exe, 0000000C.00000003.3133424521.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3043037445.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.000000000057A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3984382974.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3802186945.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3440475873.000000000055E000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://tataragirld.site/2LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763037212.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3677453061.0000000000561000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000003.3585962972.0000000000561000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://tataragirld.site/2009_New_England_Patriots_seasonLocalCtrl_alpha_v3.exe, 0000000C.00000002.3763182088.0000000000A0E000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.softwareok.comAdobeSync.exe, 00000003.00000002.2181217677.00000000083D3000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2240274765.0000000008458000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2526095704.0000000005893000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000000.2463924271.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000C.00000002.3763427984.000000000274E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000D.00000002.2606093480.0000000007E79000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000E.00000002.2832900257.0000000005647000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4013091280.00000000026E0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.4024991040.00000001401E0000.00000002.00000001.01000000.00000015.sdmpfalse
                                  		high
                                  https://tataragirld.site/7LocalCtrl_alpha_v3.exe, 0000000C.00000002.3762941318.00000000004FC000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.3711668616.000000000054A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://appsyndication.org/2006/appsyn8Rmoal0v85.exefalse
                                    		high

                                    World Map of Contacted IPs

                                    ⊘No contacted IP infos

                                    General Information

                                    Joe Sandbox version:42.0.0 Malachite
                                    Analysis ID:1586710
                                    Start date and time:2025-01-09 14:52:00 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 10m 55s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Run name:Run with higher sleep bypass
                                    Number of analysed new started processes analysed:17
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:8Rmoal0v85.exe
                                    renamed because original name is a hash value
                                    Original Sample Name:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20.exe
                                    Detection:MAL
                                    Classification:mal84.evad.winEXE@18/26@13/0
                                    EGA Information:
                                    • Successful, ratio: 50%
                                    HCA Information:
                                    • Successful, ratio: 99%
                                    • Number of executed functions: 116
                                    • Number of non-executed functions: 260
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe
                                    • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                    • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                    Warnings

                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197, 173.222.162.64
                                    • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Execution Graph export aborted for target AdobeSync.exe, PID 2736 because there are no executed function
                                    • Execution Graph export aborted for target AdobeSync.exe, PID 5392 because there are no executed function
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • VT rate limit hit for: 8Rmoal0v85.exe

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    14:53:10AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT14D8.tmp
                                    14:53:23AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helpmonitorv3.lnk

                                    Joe Sandbox View / Context

                                    IPs

                                    ⊘No context

                                    Domains

                                    ⊘No context

                                    ASNs

                                    ⊘No context

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeK3UtwU3CH9.msiGet hashmaliciousUnknownBrowse
                                      24EPV9vjc5.exeGet hashmaliciousUnknownBrowse
                                        VmjvNTbD5J.exeGet hashmaliciousUnknownBrowse
                                          1wrLmYiC62.exeGet hashmaliciousUnknownBrowse
                                            vV5EOx0ipU.exeGet hashmaliciousUnknownBrowse
                                              kXzODlqJak.exeGet hashmaliciousUnknownBrowse
                                                cLm7ThwEvh.msiGet hashmaliciousUnknownBrowse
                                                  LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                                    w3245.exeGet hashmaliciousUnknownBrowse

                                                      Created / dropped Files

                                                      C:\Users\user\AppData\Local\Temp\457357e6

                                                      Download File
                                                      Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):5661033
                                                      Entropy (8bit):7.746170690090464
                                                      Encrypted:false
                                                      SSDEEP:98304:XKGa0QJjiSpPrWxtK/FsHkI5uAoiGZj6Hu9UEg0ZFLKVSZqxvmiw5tZ1Lb2YVc:XKnti5xI/FsHkI5u1icj6H6UwFWoZCbn
                                                      MD5:598C9166E16BCB13218EFB55C6B200A6
                                                      SHA1:AF272F5D3D2A678F00121794818467FFEDFC2EF0
                                                      SHA-256:2CF6A708B010D5B2678073A7CD396750B37107BDD6B1EE295BF690AAEBA02D64
                                                      SHA-512:73679E36D042827656B1A644B56773CB52F96AAD134D8EB5F1424BEF28DE32A1DCB1E1C0CA8F64016E82155E44343D7313D9B1AEEBABEF0D3BF4C052B49CF1D3
                                                      Malicious:false
                                                      Preview:. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 3..ab..af.|...R]..FF..I\..WA..TS......Un..OU..MA..TS..UB.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..O{..T[..IH..X2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..Oq..AF..NA..NQ. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..w{..i`..m[..OA..T...tn..A_..O@. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2...........2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.

                                                      C:\Users\user\AppData\Local\Temp\5b15551c

                                                      Download File
                                                      Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):5661033
                                                      Entropy (8bit):7.746169982347492
                                                      Encrypted:false
                                                      SSDEEP:98304:YKGa0QJjiSpPrWxtK/FsHkI5uAoiGZj6Hu9UEg0ZFLKVSZqxvmiw5tZ1Lb2YVc:YKnti5xI/FsHkI5u1icj6H6UwFWoZCbn
                                                      MD5:D5A246638CED03A4683A7B3C640E57B0
                                                      SHA1:A9A122AFC7E6F0CFAD4139C8628542A024007684
                                                      SHA-256:1B05C30CB81C046F497787ABBD1B018AA51F999DBD48EEC69D559A9DABC08F50
                                                      SHA-512:E2844CB65CD14511E5A1137D1F026F2C9DE4F4BF77203C2AD49D5735B65725B5FA8C337AD1C2B26AC980F372392414C3518A15ADD8C3DEF57C3A5A8E76830C7A
                                                      Malicious:false
                                                      Preview:. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 3..ab..af.|...R]..FF..I\..WA..TS......Un..OU..MA..TS..UB.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..O{..T[..IH..X2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..Oq..AF..NA..NQ. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2..w{..i`..m[..OA..T...tn..A_..O@. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2...........2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.. 2.

                                                      C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

                                                      Download File
                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2364728
                                                      Entropy (8bit):6.606009669324617
                                                      Encrypted:false
                                                      SSDEEP:49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
                                                      MD5:967F4470627F823F4D7981E511C9824F
                                                      SHA1:416501B096DF80DDC49F4144C3832CF2CADB9CB2
                                                      SHA-256:B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
                                                      SHA-512:8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Joe Sandbox View:
                                                      • Filename: K3UtwU3CH9.msi, Detection: malicious, Browse
                                                      • Filename: 24EPV9vjc5.exe, Detection: malicious, Browse
                                                      • Filename: VmjvNTbD5J.exe, Detection: malicious, Browse
                                                      • Filename: 1wrLmYiC62.exe, Detection: malicious, Browse
                                                      • Filename: vV5EOx0ipU.exe, Detection: malicious, Browse
                                                      • Filename: kXzODlqJak.exe, Detection: malicious, Browse
                                                      • Filename: cLm7ThwEvh.msi, Detection: malicious, Browse
                                                      • Filename: LVkAi4PBv6.exe, Detection: malicious, Browse
                                                      • Filename: w3245.exe, Detection: malicious, Browse
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\Scabbard_20250109085253.log

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:ASCII text, with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):984
                                                      Entropy (8bit):5.36016381079544
                                                      Encrypted:false
                                                      SSDEEP:24:OlybAIeLLzml+fblScP2NllScP2JJlScP2RaDTlScP2ilScP2W:Ol0xYmlkldAldcldbPldlld1
                                                      MD5:F38557D6605038ECDAC2641AB92A3B0E
                                                      SHA1:F3682F73404742A7D230E60605D69FAA9972ABEB
                                                      SHA-256:F929A5846441EEECA3BFBBD1D58394944D9639CE7AEDCE8DF4CF3623C4E0BCEB
                                                      SHA-512:991BFF7983357D7F76E25156C5DA0262B8DAB470F7B191018708F92C8C3BC86C29B2726585F4DA42C48EFF7157A72D0F34CE137FB311153BA4F1D7D692477112
                                                      Malicious:false
                                                      Preview:[0838:1718][2025-01-09T08:52:53]i001: Burn v3.11.1.2318, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe..[0838:1718][2025-01-09T08:52:53]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\8Rmoal0v85.exe -burn.filehandle.attached=640 -burn.filehandle.self=680'..[0838:1718][2025-01-09T08:52:53]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\8Rmoal0v85.exe'..[0838:1718][2025-01-09T08:52:53]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[0838:1718][2025-01-09T08:52:53]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\Scabbard_20250109085253.log'..[0838:1718][2025-01-09T08:52:53]i000: Setting string variable 'WixBundleName' to value 'Scabbard'..[0838:1718][2025-01-09T08:52:53]i000: Setting string variable 'WixBundleManufacturer' to value 'Ravine'..

                                                      C:\Users\user\AppData\Local\Temp\pqclclekwl

                                                      Download File
                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 9 12:52:55 2025, mtime=Thu Jan 9 12:52:55 2025, atime=Fri Jan 3 12:50:46 2025, length=1219488, window=hide
                                                      Category:dropped
                                                      Size (bytes):924
                                                      Entropy (8bit):5.031533657973559
                                                      Encrypted:false
                                                      SSDEEP:24:89S/DClXUi+IaHAeYRqlUAz1yUgHAeYxqcazm:8o/DClZyAeqqljBmAeGaz
                                                      MD5:2E372DBE6FE67C471FD1ACE10F98EB1A
                                                      SHA1:9CFC1AA9042055F4026FB13F522D25580ECD74E4
                                                      SHA-256:4EBAE83E7046675C31BAD43140BA0A50FB2FE908D2C313571B156BF146ECA978
                                                      SHA-512:705878A42A8127313B5370CF6E72F28F0ECAAD3B3C4817E2D93C148CD2ACFE33803818C2A5E31EB47A4B0716FD057023D658C46410C5A36348BAB2222140A1F3
                                                      Malicious:false
                                                      Preview:L..................F.... ......b......b.....}.]............................:..DG..Yr?.D..U..k0.&...&.......$..S...:Qi.b......b......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2)Z.n...........................^.A.p.p.D.a.t.a...B.V.1.....)Z.n..Roaming.@......EW<2)Z.n..../.....................#.^.R.o.a.m.i.n.g.....f.1.....)Z.n..PATCHR~1..N......)Z.n)Z.n..........................3.D.P.a.t.c.h.R.e.a.d.e.r.W.C.F.....h.2.....#ZWn .ADOBES~1.EXE..L......)Z.n)Z.n..............................A.d.o.b.e.S.y.n.c...e.x.e.......m...............-.......l............]%d.....C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe..*.....\.....\.R.o.a.m.i.n.g.\.P.a.t.c.h.R.e.a.d.e.r.W.C.F.\.A.d.o.b.e.S.y.n.c...e.x.e.`.......X.......549163...........hT..CrF.f4... .....Jc...-...-$..hT..CrF.f4... .....Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                      C:\Users\user\AppData\Local\Temp\skfbgbpiysw

                                                      Download File
                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                      File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2564608
                                                      Entropy (8bit):6.715211244010203
                                                      Encrypted:false
                                                      SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                      MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                      SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                      SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                      SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                      • Antivirus: ReversingLabs, Detection: 24%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\towcn

                                                      Download File
                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                      File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                      Category:dropped
                                                      Size (bytes):2564608
                                                      Entropy (8bit):6.715211244010203
                                                      Encrypted:false
                                                      SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                      MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                      SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                      SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                      SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                      • Antivirus: ReversingLabs, Detection: 24%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):168960
                                                      Entropy (8bit):6.635989544957891
                                                      Encrypted:false
                                                      SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                      MD5:77610CBDCAC173785E2FB18CCB522574
                                                      SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                      SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                      SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 30%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):1219488
                                                      Entropy (8bit):6.312582930861741
                                                      Encrypted:false
                                                      SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                      MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                      SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                      SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                      SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):110472
                                                      Entropy (8bit):6.411600464209584
                                                      Encrypted:false
                                                      SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                      MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                      SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                      SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                      SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\choirgirl.pdf

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):62969
                                                      Entropy (8bit):4.539146899101455
                                                      Encrypted:false
                                                      SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                      MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                      SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                      SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                      SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                      Malicious:false
                                                      Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\intermixture.zip

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):4526833
                                                      Entropy (8bit):7.959653744732072
                                                      Encrypted:false
                                                      SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                      MD5:3085505DB1512B966530B829E136BDCF
                                                      SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                      SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                      SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                      Malicious:false
                                                      Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):570496
                                                      Entropy (8bit):6.5259314477231305
                                                      Encrypted:false
                                                      SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                      MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                      SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                      SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                      SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):653952
                                                      Entropy (8bit):6.885961951552677
                                                      Encrypted:false
                                                      SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                      MD5:11D49148A302DE4104DED6A92B78B0ED
                                                      SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                      SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                      SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):249232
                                                      Entropy (8bit):6.822042592978165
                                                      Encrypted:false
                                                      SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                      MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                      SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                      SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                      SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AXE8SharedExpat.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):168960
                                                      Entropy (8bit):6.635989544957891
                                                      Encrypted:false
                                                      SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                      MD5:77610CBDCAC173785E2FB18CCB522574
                                                      SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                      SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                      SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 30%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):1219488
                                                      Entropy (8bit):6.312582930861741
                                                      Encrypted:false
                                                      SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                      MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                      SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                      SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                      SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\BIB.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):110472
                                                      Entropy (8bit):6.411600464209584
                                                      Encrypted:false
                                                      SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                      MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                      SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                      SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                      SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\BootstrapperApplicationData.xml

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (473), with CRLF line terminators
                                                      Category:dropped
                                                      Size (bytes):2006
                                                      Entropy (8bit):3.7572989677816073
                                                      Encrypted:false
                                                      SSDEEP:48:y+03qHhhO7YDTT3ne1REDHV5JC0wNqycUbTXRC+bLqihGrWrol:Xn7n6q80wMycsRCDKGrN
                                                      MD5:ADBA259B1418C9ED84277688BFEEFAA7
                                                      SHA1:A6EF522036403047FF578DEF1E0AFD616A277357
                                                      SHA-256:6DF90329C4E3DF98DBB91556C98CDB46CD0258B49A500999284096A9DF972BDA
                                                      SHA-512:9F90BD3C1892CE45870DE3FEC0F83516E5B61C1774024C03EC2BCDAEB7C8AC1F05536BF0403C77F520D8D39C0ACBE11769A32A3FE49571B71F1D4DCC5FCFFE66
                                                      Malicious:false
                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".S.c.a.b.b.a.r.d.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.5.c.6.7.9.b.6.d.-.9.8.d.4.-.4.b.7.8.-.9.6.0.a.-.1.8.2.1.c.9.2.2.7.4.d.b.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.6.C.D.E.7.8.E.C.-.4.C.1.C.-.4.6.A.B.-.B.B.E.9.-.9.7.4.6.B.E.0.D.7.F.8.6.}.". .P.e.r.M.a.c.h.i.n.e.=.".n.o.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".S.l.u.i.t.". .V.i.t.a.l.=.".y.e.s.". .D.i.s.p.l.a.y.N.a.m.e.=.".P.y.t.h.o.n. .3...1.2...5. .E.x.e.c.u.t.a.b.l.e.s. .(.6.4.-.b.i.t.).". .D.o.w.n.l.o.a.d.S.i.z.e.=.".7.4.1.3.7.6.". .P.a.c.k.a.g.e.S.i.z.e.=.".7.4.1.3.7.6.".

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\Quadruple.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):255392
                                                      Entropy (8bit):6.5751135995470245
                                                      Encrypted:false
                                                      SSDEEP:6144:z7qdWWmoR0sztnfGIUbmUL1ueM+d9euhAOZD3FCP3z:Sssztnfu9ueM+doKX4P3z
                                                      MD5:7C95B91566BA5A2D8BF70C2BCF13D712
                                                      SHA1:B01F54AE2964480B8AEB2817285219AB8A2C79C0
                                                      SHA-256:39230D24CF7602FF2B00A7FF13BA5160B9B3446FBA7C6F6295DD4FB2EB408DF5
                                                      SHA-512:AB70A77C05EC42B77166D2E7FC81B18AD390E2CB32249F35355AFD4271AEDCFBDE882992AE0E84A9F95453CB9FD05AE224713EE3FDA93BABC6C9CFB572B50FAD
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.o.1.o.1.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1.o.1.o.1...0.o.1...0.o.1..W1.o.1.o?1.o.1...0.o.1Rich.o.1................PE..L...C.3`.........."!.........R......................................................~.....@......................... .......,...x.......p........................(...`..p...................@a......p...@...................<...@....................text............................... ..`.rdata..N...........................@..@.data...............................@....rsrc...p...........................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\choirgirl.pdf

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):62969
                                                      Entropy (8bit):4.539146899101455
                                                      Encrypted:false
                                                      SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                      MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                      SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                      SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                      SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                      Malicious:false
                                                      Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\intermixture.zip

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):4526833
                                                      Entropy (8bit):7.959653744732072
                                                      Encrypted:false
                                                      SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                      MD5:3085505DB1512B966530B829E136BDCF
                                                      SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                      SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                      SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                      Malicious:false
                                                      Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcp90.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):570496
                                                      Entropy (8bit):6.5259314477231305
                                                      Encrypted:false
                                                      SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                      MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                      SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                      SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                      SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\msvcr90.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):653952
                                                      Entropy (8bit):6.885961951552677
                                                      Encrypted:false
                                                      SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                      MD5:11D49148A302DE4104DED6A92B78B0ED
                                                      SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                      SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                      SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                      Malicious:false
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\sqlite.dll

                                                      Download File
                                                      Process:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):249232
                                                      Entropy (8bit):6.822042592978165
                                                      Encrypted:false
                                                      SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                      MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                      SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                      SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                      SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe

                                                      Download File
                                                      Process:C:\Users\user\Desktop\8Rmoal0v85.exe
                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):6305325
                                                      Entropy (8bit):7.9787714785946955
                                                      Encrypted:false
                                                      SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
                                                      MD5:9C540950F5A8981844FF33BFC55D2F36
                                                      SHA1:8C70F2BCB995CE313843CF7103C659C12EB263DC
                                                      SHA-256:DD53AC67D905DEFD4BD1F2B9B413DFC679E7C076E92792BE650C38659E1557C5
                                                      SHA-512:7D87E02B60647134758F4C20BDB18A1DEF78BC9B69D337B6EE6D9B190968749D028479D0F6758CDFD8C76DF454F7AE68395A4EBDCB6D99CEA5B0B48CD5BA685B
                                                      Malicious:true
                                                      Antivirus:
                                                      • Antivirus: ReversingLabs, Detection: 45%
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z..........................................@.......................................@..................................................................`...=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=...`...>..."..............@..B................................................................................................................................................................................................................................................

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Entropy (8bit):7.982299622775732
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:8Rmoal0v85.exe
                                                      File size:7'012'352 bytes
                                                      MD5:9c4e46ef2e0ad08e7040de7b3c1e60e7
                                                      SHA1:72d4a6613e520cb8b39e1ac4b347270cc1450fff
                                                      SHA256:538615f6db5d9eabb6b96c278f6b07f9eb4872bcc7a1f5f9febc03ac548aea20
                                                      SHA512:88022929c133246f0bd5178083abd31d006077897822bfb7d9f2dc20de88523d914740dff03a29935c6a55901a03aa29cb04fab82d425c5cf73c001f11b28e99
                                                      SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvgEh7:r58jucejnmkVY4zoZ5Qrh7
                                                      TLSH:CC662332A4614033D7F201B3AD6892347EBCEF28175099A9E3D4BD5D6EF44922BB7253
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@.......@......y@.......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@.

                                                      File Icon

                                                      Icon Hash:a9e8e8e9e8e8e8a9

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x42e2a6
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x5A10AD86 [Sat Nov 18 22:00:38 2017 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:5
                                                      OS Version Minor:1
                                                      File Version Major:5
                                                      File Version Minor:1
                                                      Subsystem Version Major:5
                                                      Subsystem Version Minor:1
                                                      Import Hash:d7e2fd259780271687ffca462b9e69b7

                                                      Entrypoint Preview

                                                      Instruction
                                                      call 00007F120508747Fh
                                                      jmp 00007F1205086DF3h
                                                      mov eax, dword ptr [esp+08h]
                                                      mov ecx, dword ptr [esp+10h]
                                                      or ecx, eax
                                                      mov ecx, dword ptr [esp+0Ch]
                                                      jne 00007F1205086F6Bh
                                                      mov eax, dword ptr [esp+04h]
                                                      mul ecx
                                                      retn 0010h
                                                      push ebx
                                                      mul ecx
                                                      mov ebx, eax
                                                      mov eax, dword ptr [esp+08h]
                                                      mul dword ptr [esp+14h]
                                                      add ebx, eax
                                                      mov eax, dword ptr [esp+08h]
                                                      mul ecx
                                                      add edx, ebx
                                                      pop ebx
                                                      retn 0010h
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      cmp cl, 00000040h
                                                      jnc 00007F1205086F77h
                                                      cmp cl, 00000020h
                                                      jnc 00007F1205086F68h
                                                      shrd eax, edx, cl
                                                      shr edx, cl
                                                      ret
                                                      mov eax, edx
                                                      xor edx, edx
                                                      and cl, 0000001Fh
                                                      shr eax, cl
                                                      ret
                                                      xor eax, eax
                                                      xor edx, edx
                                                      ret
                                                      push ebp
                                                      mov ebp, esp
                                                      jmp 00007F1205086F6Fh
                                                      push dword ptr [ebp+08h]
                                                      call 00007F120508D7ECh
                                                      pop ecx
                                                      test eax, eax
                                                      je 00007F1205086F71h
                                                      push dword ptr [ebp+08h]
                                                      call 00007F120508D875h
                                                      pop ecx
                                                      test eax, eax
                                                      je 00007F1205086F48h
                                                      pop ebp
                                                      ret
                                                      cmp dword ptr [ebp+08h], FFFFFFFFh
                                                      je 00007F1205087804h
                                                      jmp 00007F12050877E1h
                                                      push ebp
                                                      mov ebp, esp
                                                      push dword ptr [ebp+08h]
                                                      call 00007F120508781Dh
                                                      pop ecx
                                                      pop ebp
                                                      ret
                                                      push ebp
                                                      mov ebp, esp
                                                      test byte ptr [ebp+08h], 00000001h
                                                      push esi
                                                      mov esi, ecx
                                                      mov dword ptr [esi], 00460DB8h
                                                      je 00007F1205086F6Ch
                                                      push 0000000Ch
                                                      push esi
                                                      call 00007F1205086F3Dh
                                                      pop ecx
                                                      pop ecx
                                                      mov eax, esi
                                                      pop esi
                                                      pop ebp

                                                      Rich Headers

                                                      Programming Language:
                                                      • [ C ] VS2008 SP1 build 30729
                                                      • [IMP] VS2008 SP1 build 30729

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x686b40xb4.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x6d0000x189ac.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x860000x3dfc.reloc
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x676500x54.rdata
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x676a40x18.rdata
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x670300x40.rdata
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x4b0000x3e0.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x682340x100.rdata
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x499370x49a002319c0baa707bb66cc0bc08c55a13d8cFalse0.5314688561120543data6.570006046413636IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x4b0000x1ed600x1ee008ad6c4e18165c6d8ccdc97bab683438dFalse0.3136386639676113data5.114228301263695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0x6a0000x17300xa0000fde973df27dc2d36084e16d6dddbdfFalse0.274609375firmware 2005 v9319 (revision 0) N\346@\273\261\031\277D V2, 0 bytes or less, UNKNOWN2 0xffffffff, at 0 0 bytes , at 0 0 bytes , at 0x20a146003.1526594027632213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .wixburn0x6c0000x380x2006a6fa226648aa5455d00e43308ab550fFalse0.107421875data0.5813091016060967IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .rsrc0x6d0000x189ac0x18a00768107f716c3d4350e9c7978a9a75946False0.6123790450507615data7.16247135144247IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .reloc0x860000x3dfc0x3e00dd2c47fa48872886af4c9a2e5bd90cccFalse0.8097278225806451data6.794335469567533IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_ICON0x6d2c80xaf05PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.00046869768999
                                                      RT_ICON0x781d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 0EnglishUnited States0.2670642418516769
                                                      RT_ICON0x7c3f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.3201244813278008
                                                      RT_ICON0x7e9a00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 0EnglishUnited States0.3479289940828402
                                                      RT_ICON0x804080x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3897748592870544
                                                      RT_ICON0x814b00x988Device independent bitmap graphic, 24 x 48 x 32, image size 0EnglishUnited States0.4389344262295082
                                                      RT_ICON0x81e380x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 0EnglishUnited States0.45290697674418606
                                                      RT_ICON0x824f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.6338652482269503
                                                      RT_MESSAGETABLE0x829580x2840dataEnglishUnited States0.28823757763975155
                                                      RT_GROUP_ICON0x851980x76dataEnglishUnited States0.7203389830508474
                                                      RT_VERSION0x852100x2c8dataEnglishUnited States0.47752808988764045
                                                      RT_MANIFEST0x854d80x4d2XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminatorsEnglishUnited States0.47568881685575365

                                                      Imports

                                                      DLLImport
                                                      ADVAPI32.dllRegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DecryptFileW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
                                                      USER32.dllPeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
                                                      OLEAUT32.dllVariantInit, SysAllocString, VariantClear, SysFreeString
                                                      GDI32.dllDeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
                                                      SHELL32.dllCommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
                                                      ole32.dllCoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
                                                      KERNEL32.dllGetCommandLineA, GetCPInfo, GetOEMCP, CloseHandle, CreateFileW, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, FindClose, GetCommandLineW, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, GetCurrentProcess, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, FreeLibrary, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetNativeSystemInfo, GetModuleHandleExW, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetEnvironmentStringsW, VerifyVersionInfoW, GetVolumePathNameW, GetDateFormatW, GetUserDefaultUILanguage, GetSystemDefaultLangID, GetUserDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, InterlockedExchange, InterlockedCompareExchange, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, OpenProcess, GetProcessId, WaitForSingleObject, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, InterlockedIncrement, InterlockedDecrement, ResetEvent, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, CreateFileMappingW, GetThreadLocale, IsValidCodePage, FindFirstFileExW, FreeEnvironmentStringsW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DecodePointer, WriteConsoleW, GetModuleHandleA, GlobalAlloc, GlobalFree, GetFileSizeEx, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetComputerNameW, SetCurrentDirectoryW, GetFileType, GetACP, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, LoadLibraryExA
                                                      RPCRT4.dllUuidCreate

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishUnited States

                                                      Network Behavior

                                                      Network Port Distribution

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Jan 9, 2025 14:54:05.191041946 CET5814853192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:05.200803995 CET53581481.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:14.233256102 CET5588153192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:14.242542028 CET53558811.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:23.278733015 CET6369453192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:23.287559986 CET53636941.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:32.310523033 CET5304753192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:32.326148987 CET53530471.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:41.366863966 CET6401053192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:41.382122993 CET53640101.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:50.423439980 CET6108553192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:50.430958986 CET53610851.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:54:59.471635103 CET6402153192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:54:59.481164932 CET53640211.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:08.518138885 CET5396453192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:08.527378082 CET53539641.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:17.567262888 CET5602953192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:17.576220036 CET53560291.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:26.712821007 CET5410953192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:26.722196102 CET53541091.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:39.189771891 CET5352053192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:39.199917078 CET53535201.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:48.252321005 CET6133453192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:48.262337923 CET53613341.1.1.1192.168.2.6
                                                      Jan 9, 2025 14:55:57.345144033 CET5368553192.168.2.61.1.1.1
                                                      Jan 9, 2025 14:55:57.403661966 CET53536851.1.1.1192.168.2.6

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Jan 9, 2025 14:54:05.191041946 CET192.168.2.61.1.1.10x22deStandard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:14.233256102 CET192.168.2.61.1.1.10xc6efStandard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:23.278733015 CET192.168.2.61.1.1.10x6fa9Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:32.310523033 CET192.168.2.61.1.1.10x9045Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:41.366863966 CET192.168.2.61.1.1.10xb9c7Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:50.423439980 CET192.168.2.61.1.1.10x5821Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:59.471635103 CET192.168.2.61.1.1.10xd8aaStandard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:08.518138885 CET192.168.2.61.1.1.10xf20cStandard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:17.567262888 CET192.168.2.61.1.1.10xee83Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:26.712821007 CET192.168.2.61.1.1.10x2b9eStandard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:39.189771891 CET192.168.2.61.1.1.10xea81Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:48.252321005 CET192.168.2.61.1.1.10x59d3Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:57.345144033 CET192.168.2.61.1.1.10xd012Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Jan 9, 2025 14:54:05.200803995 CET1.1.1.1192.168.2.60x22deName error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:14.242542028 CET1.1.1.1192.168.2.60xc6efName error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:23.287559986 CET1.1.1.1192.168.2.60x6fa9Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:32.326148987 CET1.1.1.1192.168.2.60x9045Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:41.382122993 CET1.1.1.1192.168.2.60xb9c7Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:50.430958986 CET1.1.1.1192.168.2.60x5821Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:54:59.481164932 CET1.1.1.1192.168.2.60xd8aaName error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:08.527378082 CET1.1.1.1192.168.2.60xf20cName error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:17.576220036 CET1.1.1.1192.168.2.60xee83Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:26.722196102 CET1.1.1.1192.168.2.60x2b9eName error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:39.199917078 CET1.1.1.1192.168.2.60xea81Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:48.262337923 CET1.1.1.1192.168.2.60x59d3Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                      Jan 9, 2025 14:55:57.403661966 CET1.1.1.1192.168.2.60xd012Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:08:52:52
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\Desktop\8Rmoal0v85.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\Desktop\8Rmoal0v85.exe"
                                                      Imagebase:0xdc0000
                                                      File size:7'012'352 bytes
                                                      MD5 hash:9C4E46EF2E0AD08E7040DE7B3C1E60E7
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:08:52:53
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe" -burn.clean.room="C:\Users\user\Desktop\8Rmoal0v85.exe" -burn.filehandle.attached=640 -burn.filehandle.self=680
                                                      Imagebase:0x8f0000
                                                      File size:6'305'325 bytes
                                                      MD5 hash:9C540950F5A8981844FF33BFC55D2F36
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Antivirus matches:
                                                      • Detection: 45%, ReversingLabs
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:3
                                                      Start time:08:52:53
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\Temp\{E2192F6D-48B5-4B25-B71B-B4DB185F2034}\.ba\AdobeSync.exe
                                                      Imagebase:0x5f0000
                                                      File size:1'219'488 bytes
                                                      MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Antivirus matches:
                                                      • Detection: 0%, ReversingLabs
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:4
                                                      Start time:08:52:55
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                      Imagebase:0x920000
                                                      File size:1'219'488 bytes
                                                      MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Antivirus matches:
                                                      • Detection: 0%, ReversingLabs
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:5
                                                      Start time:08:52:56
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\SysWOW64\cmd.exe
                                                      Imagebase:0x1c0000
                                                      File size:236'544 bytes
                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:6
                                                      Start time:08:52:56
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:12
                                                      Start time:08:53:24
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                      Imagebase:0x140000000
                                                      File size:2'364'728 bytes
                                                      MD5 hash:967F4470627F823F4D7981E511C9824F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Antivirus matches:
                                                      • Detection: 0%, ReversingLabs
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:13
                                                      Start time:08:53:31
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:"C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
                                                      Imagebase:0x920000
                                                      File size:1'219'488 bytes
                                                      MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:true

                                                      General

                                                      Target ID:14
                                                      Start time:08:53:32
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\SysWOW64\cmd.exe
                                                      Imagebase:0x1c0000
                                                      File size:236'544 bytes
                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:15
                                                      Start time:08:53:32
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff66e660000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:16
                                                      Start time:08:53:53
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                      Imagebase:0x140000000
                                                      File size:2'364'728 bytes
                                                      MD5 hash:967F4470627F823F4D7981E511C9824F
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 00DC3CC4 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 320fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 704 dc3cc4-dc3d51 call def8e0 * 2 GetFileAttributesW 709 dc3d85-dc3d88 704->709 710 dc3d53-dc3d5a GetLastError 704->710 711 dc3d8e-dc3d91 709->711 712 dc40d5 709->712 713 dc3d5c-dc3d5e 710->713 714 dc3d5f-dc3d61 710->714 715 dc3dca-dc3dd1 711->715 716 dc3d93-dc3da6 SetFileAttributesW 711->716 719 dc40da-dc40e3 712->719 713->714 717 dc3d6e 714->717 718 dc3d63-dc3d6c 714->718 721 dc3de0-dc3de8 715->721 722 dc3dd3-dc3dda 715->722 716->715 720 dc3da8-dc3dae GetLastError 716->720 717->709 723 dc3d70-dc3d71 717->723 718->717 724 dc40ec-dc40f3 719->724 725 dc40e5-dc40e6 FindClose 719->725 728 dc3dbb 720->728 729 dc3db0-dc3db9 720->729 731 dc3dea-dc3dfe 721->731 732 dc3e25-dc3e40 call dc2d58 721->732 722->721 730 dc4058 722->730 733 dc3d76-dc3d80 call dc3821 723->733 726 dc40f5-dc40fb call e05636 724->726 727 dc4100-dc4112 call dee06f 724->727 725->724 726->727 737 dc3dbd 728->737 738 dc3dc2-dc3dc8 728->738 729->728 739 dc405e-dc406c RemoveDirectoryW 730->739 731->732 749 dc3e00-dc3e06 GetLastError 731->749 732->724 748 dc3e46-dc3e62 FindFirstFileW 732->748 733->724 737->738 738->733 739->719 744 dc406e-dc4074 GetLastError 739->744 746 dc407f-dc4085 744->746 747 dc4076-dc4079 744->747 750 dc4087-dc4089 746->750 751 dc40a1-dc40a3 746->751 747->746 752 dc3e89-dc3e93 748->752 753 dc3e64-dc3e6a GetLastError 748->753 754 dc3e08-dc3e11 749->754 755 dc3e13 749->755 758 dc408b-dc409d MoveFileExW 750->758 759 dc40a5-dc40ab 750->759 751->719 751->759 762 dc3eba-dc3ee0 call dc2d58 752->762 763 dc3e95-dc3e9e 752->763 760 dc3e6c-dc3e75 753->760 761 dc3e77 753->761 754->755 756 dc3e1a-dc3e20 755->756 757 dc3e15 755->757 756->733 757->756 758->759 765 dc409f 758->765 766 dc3ffa-dc4004 call dc3821 759->766 760->761 767 dc3e7e-dc3e7f 761->767 768 dc3e79 761->768 762->719 777 dc3ee6-dc3ef3 762->777 769 dc3fbd-dc3fcd FindNextFileW 763->769 770 dc3ea4-dc3eab 763->770 765->751 766->719 767->752 768->767 773 dc404d-dc4052 GetLastError 769->773 774 dc3fcf-dc3fd5 769->774 770->762 771 dc3ead-dc3eb4 770->771 771->762 771->769 778 dc4054-dc4056 773->778 779 dc40b0-dc40b6 GetLastError 773->779 774->752 780 dc3ef5-dc3ef7 777->780 781 dc3f22-dc3f29 777->781 778->739 782 dc40b8-dc40c1 779->782 783 dc40c3 779->783 780->781 784 dc3ef9-dc3f09 call dc2b0c 780->784 787 dc3f2f-dc3f31 781->787 788 dc3fb7 781->788 782->783 785 dc40ca-dc40d0 783->785 786 dc40c5 783->786 784->719 797 dc3f0f-dc3f18 call dc3cc4 784->797 785->766 786->785 790 dc3f4c-dc3f5a DeleteFileW 787->790 791 dc3f33-dc3f46 SetFileAttributesW 787->791 788->769 790->788 792 dc3f5c-dc3f5e 790->792 791->790 794 dc3fda-dc3fe0 GetLastError 791->794 795 dc402b-dc4031 GetLastError 792->795 796 dc3f64-dc3f81 GetTempFileNameW 792->796 798 dc3fed 794->798 799 dc3fe2-dc3feb 794->799 802 dc403e 795->802 803 dc4033-dc403c 795->803 800 dc4009-dc400f GetLastError 796->800 801 dc3f87-dc3fa4 MoveFileExW 796->801 813 dc3f1d 797->813 805 dc3fef 798->805 806 dc3ff4-dc3ff5 798->806 799->798 807 dc401c 800->807 808 dc4011-dc401a 800->808 809 dc3faf 801->809 810 dc3fa6-dc3fad 801->810 811 dc4045-dc404b 802->811 812 dc4040 802->812 803->802 805->806 806->766 814 dc401e 807->814 815 dc4023-dc4029 807->815 808->807 816 dc3fb5 MoveFileExW 809->816 810->816 811->766 812->811 813->788 814->815 815->766 816->788
                                                        APIs
                                                        • GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DC3D40
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3D53
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00DC3D9E
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3DA8
                                                        • GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00DC3DF6
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3E00
                                                        • FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00DC3E53
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3E64
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00DC3F3E
                                                        • DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00DC3F52
                                                        • GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00DC3F79
                                                        • MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00DC3F9C
                                                        • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00DC3FB5
                                                        • FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00DC3FC5
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3FDA
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC4009
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC402B
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC404D
                                                        • RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DC4064
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC406E
                                                        • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00DC4095
                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC40B0
                                                        • FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00DC40E6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
                                                        • String ID: 4#v$*.*$DEL$dirutil.cpp
                                                        • API String ID: 1544372074-4118715877
                                                        • Opcode ID: 4b1d01905670ae151c4ac88bc7667c69612d7e0208be50ae260e432a6bc21f6b
                                                        • Instruction ID: f097bf62a7b6b3edb4ac28ec6d2dd0987e6aaa7db78d2e8698a654fd80400959
                                                        • Opcode Fuzzy Hash: 4b1d01905670ae151c4ac88bc7667c69612d7e0208be50ae260e432a6bc21f6b
                                                        • Instruction Fuzzy Hash: 71B1F672D4123B9BDB315A658C05F9AB679AF40720F0542ADFE48BB190D7728E90DFB0
                                                        Function 00DC5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 817 dc5195-dc5243 call def8e0 * 2 GetModuleHandleW call e004f8 call e006ae call dc120a 828 dc5259-dc526a call dc42d7 817->828 829 dc5245 817->829 835 dc526c-dc5271 828->835 836 dc5273-dc528f call dc5618 CoInitializeEx 828->836 830 dc524a-dc5254 call e00237 829->830 837 dc54d4-dc54db 830->837 835->830 845 dc5298-dc52a4 call dffcae 836->845 846 dc5291-dc5296 836->846 839 dc54dd-dc54e3 call e05636 837->839 840 dc54e8-dc54ea 837->840 839->840 843 dc54ec-dc54f3 840->843 844 dc54fa-dc5518 call dcd82f call dda8d6 call ddab24 840->844 843->844 847 dc54f5 call dd41ec 843->847 866 dc551a-dc5522 844->866 867 dc5546-dc5559 call dc4fa4 844->867 854 dc52b8-dc52c7 call e00e07 845->854 855 dc52a6 845->855 846->830 847->844 864 dc52c9-dc52ce 854->864 865 dc52d0-dc52df call e02af7 854->865 857 dc52ab-dc52b3 call e00237 855->857 857->837 864->857 873 dc52e8-dc52f7 call e03565 865->873 874 dc52e1-dc52e6 865->874 866->867 869 dc5524-dc5527 866->869 878 dc555b call e03a35 867->878 879 dc5560-dc5567 867->879 869->867 872 dc5529-dc5544 call dd434c call dc5602 869->872 872->867 885 dc52f9-dc52fe 873->885 886 dc5300-dc531f GetVersionExW 873->886 874->857 878->879 881 dc556e-dc5575 879->881 882 dc5569 call e02efe 879->882 888 dc557c-dc5583 881->888 889 dc5577 call e01479 881->889 882->881 885->857 891 dc5359-dc539e call dc33c7 call dc5602 886->891 892 dc5321-dc532b GetLastError 886->892 894 dc558a-dc558c 888->894 895 dc5585 call dffdbd 888->895 889->888 920 dc53a0-dc53ab call e05636 891->920 921 dc53b1-dc53c1 call dd752a 891->921 897 dc532d-dc5336 892->897 898 dc5338 892->898 901 dc558e CoUninitialize 894->901 902 dc5594-dc559b 894->902 895->894 897->898 903 dc533f-dc5354 call dc3821 898->903 904 dc533a 898->904 901->902 906 dc559d-dc559f 902->906 907 dc55d6-dc55df call e00113 902->907 903->857 904->903 911 dc55a5-dc55ab 906->911 912 dc55a1-dc55a3 906->912 918 dc55e6-dc55ff call e00802 call dee06f 907->918 919 dc55e1 call dc45ee 907->919 913 dc55ad-dc55c6 call dd3d85 call dc5602 911->913 912->913 913->907 936 dc55c8-dc55d5 call dc5602 913->936 919->918 920->921 933 dc53cd-dc53d6 921->933 934 dc53c3 921->934 937 dc53dc-dc53df 933->937 938 dc549e-dc54ab call dc4d39 933->938 934->933 936->907 941 dc53e5-dc53e8 937->941 942 dc5476-dc5492 call dc4ae5 937->942 943 dc54b0-dc54b4 938->943 945 dc544e-dc546a call dc48ef 941->945 946 dc53ea-dc53ed 941->946 949 dc54c0-dc54d2 942->949 958 dc5494 942->958 948 dc54b6 943->948 943->949 945->949 960 dc546c 945->960 951 dc53ef-dc53f2 946->951 952 dc5426-dc5442 call dc4a88 946->952 948->949 949->837 956 dc53f4-dc53f9 951->956 957 dc5403-dc5416 call dc4c86 951->957 952->949 962 dc5444 952->962 956->957 957->949 964 dc541c 957->964 958->938 960->942 962->945 964->952
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DC5217
                                                          • Part of subcall function 00E004F8: InitializeCriticalSection.KERNEL32(00E2B5FC,?,00DC5223,00000000,?,?,?,?,?,?), ref: 00E0050F
                                                          • Part of subcall function 00DC120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00DC523F,00000000,?), ref: 00DC1248
                                                          • Part of subcall function 00DC120A: GetLastError.KERNEL32(?,?,?,00DC523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DC1252
                                                        • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DC5285
                                                          • Part of subcall function 00E00E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00E00E28
                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00DC5317
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DC5321
                                                        • CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DC558E
                                                        Strings
                                                        • Failed to initialize user state., xrefs: 00DC526C
                                                        • Failed to run per-user mode., xrefs: 00DC5494
                                                        • Failed to run RunOnce mode., xrefs: 00DC541C
                                                        • Failed to initialize COM., xrefs: 00DC5291
                                                        • Failed to run untrusted mode., xrefs: 00DC54B6
                                                        • user.cpp, xrefs: 00DC5345
                                                        • Failed to initialize XML util., xrefs: 00DC52F9
                                                        • Failed to run embedded mode., xrefs: 00DC5444
                                                        • Failed to run per-machine mode., xrefs: 00DC546C
                                                        • Failed to initialize core., xrefs: 00DC53C3
                                                        • 3.11.1.2318, xrefs: 00DC5384
                                                        • Failed to get OS info., xrefs: 00DC534F
                                                        • Failed to initialize Cryputil., xrefs: 00DC52A6
                                                        • Failed to parse command line., xrefs: 00DC5245
                                                        • Failed to initialize Regutil., xrefs: 00DC52C9
                                                        • Failed to initialize Wiutil., xrefs: 00DC52E1
                                                        • Invalid run mode., xrefs: 00DC53F9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                        • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$user.cpp
                                                        • API String ID: 3262001429-510904028
                                                        • Opcode ID: 1f70b8a502840dbc6e004d556ff8e03847fa0cb7e3839832181985c2d0755632
                                                        • Instruction ID: 1f1abd623e0391acb236c6570cae6a6ead5d141ec4d594c5b5e8bc5595f04b3e
                                                        • Opcode Fuzzy Hash: 1f70b8a502840dbc6e004d556ff8e03847fa0cb7e3839832181985c2d0755632
                                                        • Instruction Fuzzy Hash: 90B19371D4062A9BDB21AF64DC46FED76B4AF44310F540199E908B7285DB71AEC0CBB4
                                                        Function 00E0304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00E03609,00000000,?,00000000), ref: 00E03069
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00DEC025,?,00DC5405,?,00000000,?), ref: 00E03075
                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00E030B5
                                                        • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00E030C1
                                                        • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00E030CC
                                                        • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00E030D6
                                                        • CoCreateInstance.OLE32(00E2B6B8,00000000,00000001,00E0B818,?,?,?,?,?,?,?,?,?,?,?,00DEC025), ref: 00E03111
                                                        • ExitProcess.KERNEL32 ref: 00E031C0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                        • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                        • API String ID: 2124981135-499589564
                                                        • Opcode ID: b6e18ccf0910f9c3dccd6c356bfd42d962576f3af6edadeffcb704a0a269dd81
                                                        • Instruction ID: 65ddc67756446943275add113bc2eced36e06731ddbb05e9f97d3d9c1e039c8f
                                                        • Opcode Fuzzy Hash: b6e18ccf0910f9c3dccd6c356bfd42d962576f3af6edadeffcb704a0a269dd81
                                                        • Instruction Fuzzy Hash: 5441C335A02325AFDB24DBB9C845BAEB7B8EF48714F115169E901FB2D0D771DE808B90
                                                        Function 00DC1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DC10DD,?,00000000), ref: 00DC33E8
                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00DC10F6
                                                          • Part of subcall function 00DC1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC1186
                                                          • Part of subcall function 00DC1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC1191
                                                          • Part of subcall function 00DC1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DC119F
                                                          • Part of subcall function 00DC1175: GetLastError.KERNEL32(?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC11BA
                                                          • Part of subcall function 00DC1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DC11C2
                                                          • Part of subcall function 00DC1175: GetLastError.KERNEL32(?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC11D7
                                                        • CloseHandle.KERNELBASE(?,?,?,?,00E0B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00DC1131
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                        • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                        • API String ID: 3687706282-3151496603
                                                        • Opcode ID: 6d6329268351a5fcc15a7169876f9c396a6f4d6e7db8d4a0d848fdd96f825147
                                                        • Instruction ID: c7308890b74af7ee5dbf2299a35799e7eaaca32ffa7c958081bcd0a041820e13
                                                        • Opcode Fuzzy Hash: 6d6329268351a5fcc15a7169876f9c396a6f4d6e7db8d4a0d848fdd96f825147
                                                        • Instruction Fuzzy Hash: 0A21917190022DABCB109FA5DC0AFDEBBB9FB45710F544119FA20B72C2E77459448BB0
                                                        Function 00DDA0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Failed create working folder., xrefs: 00DDA0EE
                                                        • Failed to calculate working folder to ensure it exists., xrefs: 00DDA0D8
                                                        • Failed to copy working folder., xrefs: 00DDA116
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryErrorLastProcessWindows
                                                        • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                        • API String ID: 3841436932-2072961686
                                                        • Opcode ID: 9ec2fe2b631e44f7610b2dd1682268660e11bda25bb7164f5f44541482a49cee
                                                        • Instruction ID: a8964cfc78c7825563409cb68adc3705d306b2dfc3d9371128e11070d27fa6da
                                                        • Opcode Fuzzy Hash: 9ec2fe2b631e44f7610b2dd1682268660e11bda25bb7164f5f44541482a49cee
                                                        • Instruction Fuzzy Hash: 8501A732905729FB8F225F59DC06CAEBBB9DF54B20B108257F8007A321DB359E40E6B1
                                                        Function 00DF48D8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000000,?,00DF48AE,00000000,00E27F08,0000000C,00DF4A05,00000000,00000002,00000000), ref: 00DF48F9
                                                        • TerminateProcess.KERNEL32(00000000,?,00DF48AE,00000000,00E27F08,0000000C,00DF4A05,00000000,00000002,00000000), ref: 00DF4900
                                                        • ExitProcess.KERNEL32 ref: 00DF4912
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Process$CurrentExitTerminate
                                                        • String ID:
                                                        • API String ID: 1703294689-0
                                                        • Opcode ID: 770cce20930cb0c7dcefd829fca58bc56261b37c7de67f4d148a6afa7f2ddb6e
                                                        • Instruction ID: 77eb5b1422daa9e69c750d18110ca42368004c9e4e3f45650047efd7848d2e7f
                                                        • Opcode Fuzzy Hash: 770cce20930cb0c7dcefd829fca58bc56261b37c7de67f4d148a6afa7f2ddb6e
                                                        • Instruction Fuzzy Hash: A6E0863150014CAFCF116F65CD0895A3B69FF40381F058014F91597132CB76DC82CFA0
                                                        Function 00DC394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                        • RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID:
                                                        • API String ID: 1357844191-0
                                                        • Opcode ID: 49b47c2fa258a531690731e9a08e61c0e324b37e1747628081ca5d4851fad4f9
                                                        • Instruction ID: 171d949e1ea2e8bb2ba811fa50f13c86fe8ef18df41461620dcfc05dd950b2dc
                                                        • Opcode Fuzzy Hash: 49b47c2fa258a531690731e9a08e61c0e324b37e1747628081ca5d4851fad4f9
                                                        • Instruction Fuzzy Hash: B4C012321A420DABCB006FF9EC0EC9B3BACBB286027048400B905D2120C73AE0988B60
                                                        Function 00DCDF33 Relevance: 126.6, APIs: 11, Strings: 61, Instructions: 646COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00DCE058
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00DCE736
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeHeapString$AllocateProcess
                                                        • String ID: Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$Invalid cache type: %ls$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`Dv$always$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msi.dll$package.cpp$wininet.dll$yes
                                                        • API String ID: 336948655-3261472537
                                                        • Opcode ID: a865f26d8fb4d7cd392a4488990114ddf8a69bb0993d8a81210396306a16bc90
                                                        • Instruction ID: d14e47adb8e2952026fe4f19e559afe999d9d0406047c56b651ee33483565100
                                                        • Opcode Fuzzy Hash: a865f26d8fb4d7cd392a4488990114ddf8a69bb0993d8a81210396306a16bc90
                                                        • Instruction Fuzzy Hash: DF32C3B1D54327ABCB119B64CC41FAEB7B4AF04720F244669F911BB2D1D7B4ED809BA0
                                                        Function 00DCF9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 222 dcf9e3-dcfa14 call e039af 225 dcfa18-dcfa1a 222->225 226 dcfa16 222->226 227 dcfa1c-dcfa29 call e00237 225->227 228 dcfa2e-dcfa47 call e032f3 225->228 226->225 233 dcff16-dcff1b 227->233 234 dcfa49-dcfa4e 228->234 235 dcfa53-dcfa68 call e032f3 228->235 236 dcff1d-dcff1f 233->236 237 dcff23-dcff28 233->237 238 dcff0d-dcff14 call e00237 234->238 246 dcfa6a-dcfa6f 235->246 247 dcfa74-dcfa81 call dcea42 235->247 236->237 240 dcff2a-dcff2c 237->240 241 dcff30-dcff35 237->241 252 dcff15 238->252 240->241 244 dcff3d-dcff41 241->244 245 dcff37-dcff39 241->245 249 dcff4b-dcff52 244->249 250 dcff43-dcff46 call e05636 244->250 245->244 246->238 255 dcfa8d-dcfaa2 call e032f3 247->255 256 dcfa83-dcfa88 247->256 250->249 252->233 259 dcfaae-dcfac0 call e04c97 255->259 260 dcfaa4-dcfaa9 255->260 256->238 263 dcfacf-dcfae4 call e032f3 259->263 264 dcfac2-dcfaca 259->264 260->238 269 dcfae6-dcfaeb 263->269 270 dcfaf0-dcfb05 call e032f3 263->270 265 dcfd99-dcfda2 call e00237 264->265 265->252 269->238 274 dcfb07-dcfb0c 270->274 275 dcfb11-dcfb23 call e03505 270->275 274->238 278 dcfb2f-dcfb45 call e039af 275->278 279 dcfb25-dcfb2a 275->279 282 dcfb4b-dcfb4d 278->282 283 dcfdf4-dcfe0e call dcecbe 278->283 279->238 284 dcfb4f-dcfb54 282->284 285 dcfb59-dcfb6e call e03505 282->285 290 dcfe1a-dcfe32 call e039af 283->290 291 dcfe10-dcfe15 283->291 284->238 292 dcfb7a-dcfb8f call e032f3 285->292 293 dcfb70-dcfb75 285->293 298 dcfefc-dcfefd call dcf0f8 290->298 299 dcfe38-dcfe3a 290->299 291->238 303 dcfb9f-dcfbb4 call e032f3 292->303 304 dcfb91-dcfb93 292->304 293->238 308 dcff02-dcff06 298->308 300 dcfe3c-dcfe41 299->300 301 dcfe46-dcfe64 call e032f3 299->301 300->238 312 dcfe66-dcfe6b 301->312 313 dcfe70-dcfe88 call e032f3 301->313 314 dcfbc4-dcfbd9 call e032f3 303->314 315 dcfbb6-dcfbb8 303->315 304->303 305 dcfb95-dcfb9a 304->305 305->238 308->252 311 dcff08 308->311 311->238 312->238 321 dcfe8a-dcfe8c 313->321 322 dcfe95-dcfead call e032f3 313->322 323 dcfbe9-dcfbfe call e032f3 314->323 324 dcfbdb-dcfbdd 314->324 315->314 316 dcfbba-dcfbbf 315->316 316->238 321->322 325 dcfe8e-dcfe93 321->325 331 dcfeaf-dcfeb1 322->331 332 dcfeba-dcfed2 call e032f3 322->332 333 dcfc0e-dcfc23 call e032f3 323->333 334 dcfc00-dcfc02 323->334 324->323 326 dcfbdf-dcfbe4 324->326 325->238 326->238 331->332 337 dcfeb3-dcfeb8 331->337 341 dcfedb-dcfef3 call e032f3 332->341 342 dcfed4-dcfed9 332->342 343 dcfc25-dcfc27 333->343 344 dcfc33-dcfc48 call e032f3 333->344 334->333 338 dcfc04-dcfc09 334->338 337->238 338->238 341->298 350 dcfef5-dcfefa 341->350 342->238 343->344 346 dcfc29-dcfc2e 343->346 351 dcfc58-dcfc6d call e032f3 344->351 352 dcfc4a-dcfc4c 344->352 346->238 350->238 356 dcfc7d-dcfc92 call e032f3 351->356 357 dcfc6f-dcfc71 351->357 352->351 353 dcfc4e-dcfc53 352->353 353->238 361 dcfc94-dcfc96 356->361 362 dcfca2-dcfcba call e032f3 356->362 357->356 359 dcfc73-dcfc78 357->359 359->238 361->362 363 dcfc98-dcfc9d 361->363 366 dcfcbc-dcfcbe 362->366 367 dcfcca-dcfce2 call e032f3 362->367 363->238 366->367 368 dcfcc0-dcfcc5 366->368 371 dcfce4-dcfce6 367->371 372 dcfcf2-dcfd07 call e032f3 367->372 368->238 371->372 373 dcfce8-dcfced 371->373 376 dcfd0d-dcfd2a CompareStringW 372->376 377 dcfda7-dcfda9 372->377 373->238 378 dcfd2c-dcfd32 376->378 379 dcfd34-dcfd49 CompareStringW 376->379 380 dcfdab-dcfdb2 377->380 381 dcfdb4-dcfdb6 377->381 384 dcfd75-dcfd7a 378->384 385 dcfd4b-dcfd55 379->385 386 dcfd57-dcfd6c CompareStringW 379->386 380->381 382 dcfdb8-dcfdbd 381->382 383 dcfdc2-dcfdda call e03505 381->383 382->238 383->283 392 dcfddc-dcfdde 383->392 384->381 385->384 388 dcfd7c-dcfd94 call dc3821 386->388 389 dcfd6e 386->389 388->265 389->384 394 dcfdea 392->394 395 dcfde0-dcfde5 392->395 394->283 395->238
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: StringVariant$AllocClearFreeInit
                                                        • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
                                                        • API String ID: 760788290-2956246334
                                                        • Opcode ID: 7e3380a7be903fc7685f558f35c6a584c4999f0ab0bf994bea00d294df25f16c
                                                        • Instruction ID: 4173f6e580fdfddcc3e4dc2a7a2777999c9678728b09adcc3eed4219c2d7a626
                                                        • Opcode Fuzzy Hash: 7e3380a7be903fc7685f558f35c6a584c4999f0ab0bf994bea00d294df25f16c
                                                        • Instruction Fuzzy Hash: A1E1E336E44727BACB1197A0CC42FEDB6AAEF01710F151279FA11F71A1C7619E8496E0
                                                        Function 00DCB48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 396 dcb48b-dcb500 call def8e0 * 2 401 dcb538-dcb53e 396->401 402 dcb502-dcb50c GetLastError 396->402 403 dcb540 401->403 404 dcb542-dcb554 SetFilePointerEx 401->404 405 dcb50e-dcb517 402->405 406 dcb519 402->406 403->404 407 dcb588-dcb5a2 ReadFile 404->407 408 dcb556-dcb560 GetLastError 404->408 405->406 409 dcb51b 406->409 410 dcb520-dcb52d call dc3821 406->410 413 dcb5d9-dcb5e0 407->413 414 dcb5a4-dcb5ae GetLastError 407->414 411 dcb56d 408->411 412 dcb562-dcb56b 408->412 409->410 428 dcb532-dcb533 410->428 418 dcb56f 411->418 419 dcb574-dcb586 call dc3821 411->419 412->411 416 dcb5e6-dcb5ef 413->416 417 dcbbd7-dcbbeb call dc3821 413->417 420 dcb5bb 414->420 421 dcb5b0-dcb5b9 414->421 416->417 424 dcb5f5-dcb605 SetFilePointerEx 416->424 436 dcbbf0 417->436 418->419 419->428 426 dcb5bd 420->426 427 dcb5c2-dcb5d4 call dc3821 420->427 421->420 432 dcb63c-dcb654 ReadFile 424->432 433 dcb607-dcb611 GetLastError 424->433 426->427 427->428 430 dcbbf1-dcbbf7 call e00237 428->430 451 dcbbf8-dcbc0a call dee06f 430->451 440 dcb68b-dcb692 432->440 441 dcb656-dcb660 GetLastError 432->441 438 dcb61e 433->438 439 dcb613-dcb61c 433->439 436->430 445 dcb625-dcb632 call dc3821 438->445 446 dcb620 438->446 439->438 443 dcbbbc-dcbbd5 call dc3821 440->443 444 dcb698-dcb6a2 440->444 447 dcb66d 441->447 448 dcb662-dcb66b 441->448 443->436 444->443 452 dcb6a8-dcb6cb SetFilePointerEx 444->452 445->432 446->445 449 dcb66f 447->449 450 dcb674-dcb681 call dc3821 447->450 448->447 449->450 450->440 457 dcb6cd-dcb6d7 GetLastError 452->457 458 dcb702-dcb71a ReadFile 452->458 465 dcb6d9-dcb6e2 457->465 466 dcb6e4 457->466 461 dcb71c-dcb726 GetLastError 458->461 462 dcb751-dcb769 ReadFile 458->462 467 dcb728-dcb731 461->467 468 dcb733 461->468 469 dcb76b-dcb775 GetLastError 462->469 470 dcb7a0-dcb7bb SetFilePointerEx 462->470 465->466 471 dcb6eb-dcb6f8 call dc3821 466->471 472 dcb6e6 466->472 467->468 475 dcb73a-dcb747 call dc3821 468->475 476 dcb735 468->476 477 dcb777-dcb780 469->477 478 dcb782 469->478 473 dcb7bd-dcb7c7 GetLastError 470->473 474 dcb7f5-dcb814 ReadFile 470->474 471->458 472->471 480 dcb7c9-dcb7d2 473->480 481 dcb7d4 473->481 483 dcbb7d-dcbb87 GetLastError 474->483 484 dcb81a-dcb81c 474->484 475->462 476->475 477->478 485 dcb789-dcb796 call dc3821 478->485 486 dcb784 478->486 480->481 491 dcb7db-dcb7eb call dc3821 481->491 492 dcb7d6 481->492 489 dcbb89-dcbb92 483->489 490 dcbb94 483->490 494 dcb81d-dcb824 484->494 485->470 486->485 489->490 496 dcbb9b-dcbbb1 call dc3821 490->496 497 dcbb96 490->497 491->474 492->491 499 dcbb58-dcbb75 call dc3821 494->499 500 dcb82a-dcb836 494->500 516 dcbbb2-dcbbba call e00237 496->516 497->496 511 dcbb7a-dcbb7b 499->511 502 dcb838-dcb83f 500->502 503 dcb841-dcb84a 500->503 502->503 507 dcb884-dcb88b 502->507 508 dcbb1b-dcbb32 call dc3821 503->508 509 dcb850-dcb876 ReadFile 503->509 513 dcb88d-dcb8af call dc3821 507->513 514 dcb8b4-dcb8cb call dc394f 507->514 522 dcbb37-dcbb3d call e00237 508->522 509->483 512 dcb87c-dcb882 509->512 511->516 512->494 513->511 526 dcb8cd-dcb8ea call dc3821 514->526 527 dcb8ef-dcb904 SetFilePointerEx 514->527 516->451 534 dcbb43-dcbb44 522->534 526->430 530 dcb944-dcb969 ReadFile 527->530 531 dcb906-dcb910 GetLastError 527->531 535 dcb96b-dcb975 GetLastError 530->535 536 dcb9a0-dcb9ac 530->536 532 dcb91d 531->532 533 dcb912-dcb91b 531->533 538 dcb91f 532->538 539 dcb924-dcb934 call dc3821 532->539 533->532 542 dcbb45-dcbb47 534->542 543 dcb977-dcb980 535->543 544 dcb982 535->544 540 dcb9ae-dcb9ca call dc3821 536->540 541 dcb9cf-dcb9d3 536->541 538->539 559 dcb939-dcb93f call e00237 539->559 540->522 547 dcba0e-dcba21 call e04a05 541->547 548 dcb9d5-dcba09 call dc3821 call e00237 541->548 542->451 549 dcbb4d-dcbb53 call dc3a16 542->549 543->544 550 dcb989-dcb99e call dc3821 544->550 551 dcb984 544->551 565 dcba2d-dcba37 547->565 566 dcba23-dcba28 547->566 548->542 549->451 550->559 551->550 559->534 567 dcba39-dcba3f 565->567 568 dcba41-dcba49 565->568 566->559 571 dcba5a-dcbaba call dc394f 567->571 572 dcba4b-dcba53 568->572 573 dcba55-dcba58 568->573 576 dcbabc-dcbad8 call dc3821 571->576 577 dcbade-dcbaff call def360 call dcb208 571->577 572->571 573->571 576->577 577->542 584 dcbb01-dcbb11 call dc3821 577->584 584->508
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DCB502
                                                        • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB550
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DCB556
                                                        • ReadFile.KERNELBASE(00000000,00DC4461,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB59E
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 00DCB5A4
                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB601
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB607
                                                        • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB650
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB656
                                                        • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB6C7
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB6CD
                                                        • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB716
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB71C
                                                        • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB765
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB76B
                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB7B7
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB7BD
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB810
                                                        • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB872
                                                        • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB8FC
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB906
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                        • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
                                                        • API String ID: 3411815225-695169583
                                                        • Opcode ID: f20f30fef3128d56d969ddb68953fcc4938c2017705b8f47f1bac3fe0f1c57a2
                                                        • Instruction ID: b718ef4c21e82d2b3485bb6b6d39ffba1d7e1cd67e32020631ef27f47cb63615
                                                        • Opcode Fuzzy Hash: f20f30fef3128d56d969ddb68953fcc4938c2017705b8f47f1bac3fe0f1c57a2
                                                        • Instruction Fuzzy Hash: 8912D376A40336ABDB319A55CC46FAB76A4EF04720F1542AAFD04BB281D771DD808BF0
                                                        Function 00DE0D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 587 de0d16-de0d2d SetEvent 588 de0d6f-de0d7d WaitForSingleObject 587->588 589 de0d2f-de0d39 GetLastError 587->589 590 de0d7f-de0d89 GetLastError 588->590 591 de0db4-de0dbf ResetEvent 588->591 592 de0d3b-de0d44 589->592 593 de0d46 589->593 594 de0d8b-de0d94 590->594 595 de0d96 590->595 596 de0df9-de0dff 591->596 597 de0dc1-de0dcb GetLastError 591->597 592->593 598 de0d4d-de0d5d call dc3821 593->598 599 de0d48 593->599 594->595 602 de0d9d-de0db2 call dc3821 595->602 603 de0d98 595->603 600 de0e32-de0e4b call dc21ac 596->600 601 de0e01-de0e04 596->601 604 de0dcd-de0dd6 597->604 605 de0dd8 597->605 614 de0d62-de0d6a call e00237 598->614 599->598 623 de0e4d-de0e5e call e00237 600->623 624 de0e63-de0e6e SetEvent 600->624 610 de0e28-de0e2d 601->610 611 de0e06-de0e23 call dc3821 601->611 602->614 603->602 604->605 607 de0ddf-de0df4 call dc3821 605->607 608 de0dda 605->608 607->614 608->607 617 de10e8-de10ed 610->617 630 de10de-de10e4 call e00237 611->630 614->617 625 de10ef 617->625 626 de10f2-de10f8 617->626 638 de10e5-de10e7 623->638 627 de0ea8-de0eb6 WaitForSingleObject 624->627 628 de0e70-de0e7a GetLastError 624->628 625->626 634 de0eb8-de0ec2 GetLastError 627->634 635 de0ef0-de0efb ResetEvent 627->635 632 de0e7c-de0e85 628->632 633 de0e87 628->633 630->638 632->633 641 de0e8e-de0ea3 call dc3821 633->641 642 de0e89 633->642 643 de0ecf 634->643 644 de0ec4-de0ecd 634->644 639 de0efd-de0f07 GetLastError 635->639 640 de0f35-de0f3c 635->640 638->617 646 de0f09-de0f12 639->646 647 de0f14 639->647 649 de0f3e-de0f41 640->649 650 de0fab-de0fce CreateFileW 640->650 665 de10dd 641->665 642->641 651 de0ed6-de0eeb call dc3821 643->651 652 de0ed1 643->652 644->643 646->647 653 de0f1b-de0f30 call dc3821 647->653 654 de0f16 647->654 658 de0f6e-de0f72 call dc394f 649->658 659 de0f43-de0f46 649->659 656 de100b-de101f SetFilePointerEx 650->656 657 de0fd0-de0fda GetLastError 650->657 651->665 652->651 653->665 654->653 661 de1059-de1064 SetEndOfFile 656->661 662 de1021-de102b GetLastError 656->662 666 de0fdc-de0fe5 657->666 667 de0fe7 657->667 673 de0f77-de0f7c 658->673 668 de0f48-de0f4b 659->668 669 de0f67-de0f69 659->669 675 de109b-de10a8 SetFilePointerEx 661->675 676 de1066-de1070 GetLastError 661->676 671 de102d-de1036 662->671 672 de1038 662->672 665->630 666->667 677 de0fee-de1001 call dc3821 667->677 678 de0fe9 667->678 679 de0f5d-de0f62 668->679 680 de0f4d-de0f53 668->680 669->617 671->672 684 de103f-de1054 call dc3821 672->684 685 de103a 672->685 682 de0f7e-de0f98 call dc3821 673->682 683 de0f9d-de0fa6 673->683 675->638 681 de10aa-de10b4 GetLastError 675->681 686 de107d 676->686 687 de1072-de107b 676->687 677->656 678->677 679->638 680->679 689 de10b6-de10bf 681->689 690 de10c1 681->690 682->665 683->638 684->665 685->684 693 de107f 686->693 694 de1084-de1099 call dc3821 686->694 687->686 689->690 696 de10c8-de10d8 call dc3821 690->696 697 de10c3 690->697 693->694 694->665 696->665 697->696
                                                        APIs
                                                        • SetEvent.KERNEL32(?,?,?,?,?,00DE08BC,?,?), ref: 00DE0D25
                                                        • GetLastError.KERNEL32(?,?,?,?,00DE08BC,?,?), ref: 00DE0D2F
                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00DE08BC,?,?), ref: 00DE0D74
                                                        • GetLastError.KERNEL32(?,?,?,?,00DE08BC,?,?), ref: 00DE0D7F
                                                        • ResetEvent.KERNEL32(?,?,?,?,?,00DE08BC,?,?), ref: 00DE0DB7
                                                        • GetLastError.KERNEL32(?,?,?,?,00DE08BC,?,?), ref: 00DE0DC1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                        • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 1865021742-2104912459
                                                        • Opcode ID: e931d87a50493a03d498f87161147a4fdd5df14e1f6f291928878930b83a1296
                                                        • Instruction ID: 5e107a5cfa12cd81f883fcbfd37fae232174ee1ba8e2b5bebe6761b902f33aa4
                                                        • Opcode Fuzzy Hash: e931d87a50493a03d498f87161147a4fdd5df14e1f6f291928878930b83a1296
                                                        • Instruction Fuzzy Hash: 8B91E737A817B3ABD63226A75D09F6A6950BF00B20F194225BE50BF6D0D7A1DCC0C6F1
                                                        Function 00DC4D39 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 220COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 965 dc4d39-dc4d81 call def8e0 call dc33c7 970 dc4d95-dc4d9f call dd98f7 965->970 971 dc4d83-dc4d90 call e00237 965->971 977 dc4da8-dc4db7 call dd98fd 970->977 978 dc4da1-dc4da6 970->978 976 dc4f31-dc4f3b 971->976 979 dc4f3d-dc4f42 CloseHandle 976->979 980 dc4f46-dc4f4a 976->980 986 dc4dbc-dc4dc0 977->986 981 dc4ddd-dc4df8 call dc1f13 978->981 979->980 984 dc4f4c-dc4f51 CloseHandle 980->984 985 dc4f55-dc4f59 980->985 992 dc4dfa-dc4dff 981->992 993 dc4e01-dc4e15 call dd6a57 981->993 984->985 988 dc4f5b-dc4f60 CloseHandle 985->988 989 dc4f64-dc4f66 985->989 990 dc4dd7-dc4dda 986->990 991 dc4dc2 986->991 988->989 995 dc4f68-dc4f69 CloseHandle 989->995 996 dc4f6b-dc4f7f call dc2782 * 2 989->996 990->981 994 dc4dc7-dc4dd2 call e00237 991->994 992->994 1004 dc4e2f-dc4e43 call dd6b13 993->1004 1005 dc4e17 993->1005 994->976 995->996 1009 dc4f89-dc4f8d 996->1009 1010 dc4f81-dc4f84 call e05636 996->1010 1013 dc4e4c-dc4e67 call dc1f55 1004->1013 1014 dc4e45-dc4e4a 1004->1014 1007 dc4e1c 1005->1007 1011 dc4e21-dc4e2a call e00237 1007->1011 1016 dc4f8f-dc4f92 call e05636 1009->1016 1017 dc4f97-dc4f9f 1009->1017 1010->1009 1023 dc4f2e 1011->1023 1024 dc4e69-dc4e6e 1013->1024 1025 dc4e73-dc4e8c call dc1f55 1013->1025 1014->1007 1016->1017 1023->976 1024->994 1028 dc4e8e-dc4e93 1025->1028 1029 dc4e98-dc4ec4 CreateProcessW 1025->1029 1028->994 1030 dc4ec6-dc4ed0 GetLastError 1029->1030 1031 dc4f01-dc4f17 call e00a28 1029->1031 1033 dc4edd 1030->1033 1034 dc4ed2-dc4edb 1030->1034 1035 dc4f1c-dc4f20 1031->1035 1036 dc4edf 1033->1036 1037 dc4ee4-dc4efc call dc3821 1033->1037 1034->1033 1035->976 1038 dc4f22-dc4f29 call e00237 1035->1038 1036->1037 1037->1011 1038->1023
                                                        APIs
                                                          • Part of subcall function 00DC33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DC10DD,?,00000000), ref: 00DC33E8
                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DC4F40
                                                        • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DC4F4F
                                                        • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DC4F5E
                                                        • CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DC4F69
                                                        Strings
                                                        • Failed to allocate parameters for unelevated process., xrefs: 00DC4DFA
                                                        • D, xrefs: 00DC4EA9
                                                        • -%ls="%ls", xrefs: 00DC4DE6
                                                        • burn.clean.room, xrefs: 00DC4DDE
                                                        • user.cpp, xrefs: 00DC4EEA
                                                        • Failed to allocate full command-line., xrefs: 00DC4E8E
                                                        • Failed to append original command line., xrefs: 00DC4E69
                                                        • Failed to wait for clean room process: %ls, xrefs: 00DC4F23
                                                        • Failed to launch clean room process: %ls, xrefs: 00DC4EF7
                                                        • burn.filehandle.attached, xrefs: 00DC4E17
                                                        • "%ls" %ls, xrefs: 00DC4E7A
                                                        • Failed to append %ls, xrefs: 00DC4E1C
                                                        • %ls %ls, xrefs: 00DC4E55
                                                        • Failed to cache to clean room., xrefs: 00DC4DC2
                                                        • burn.filehandle.self, xrefs: 00DC4E45
                                                        • Failed to get path for current process., xrefs: 00DC4D83
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$FileModuleName
                                                        • String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                        • API String ID: 3884789274-2391192076
                                                        • Opcode ID: 4913d0f17ca3c81e6fc391654b0eb6be0688d01813fae690c1190b541eb44257
                                                        • Instruction ID: fe9ece6d37955687b1301bee2c391e10d26cc1b657e7402a15f0f5d0bbffe81d
                                                        • Opcode Fuzzy Hash: 4913d0f17ca3c81e6fc391654b0eb6be0688d01813fae690c1190b541eb44257
                                                        • Instruction Fuzzy Hash: A9716272D4022AABDB21AA94CC55FEFBB78FF04720F154259F910B7291D7719A418BF0
                                                        Function 00DD752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1042 dd752a-dd756f call def8e0 call dc762c 1047 dd757b-dd758c call dcc407 1042->1047 1048 dd7571-dd7576 1042->1048 1054 dd758e-dd7593 1047->1054 1055 dd7598-dd75a9 call dcc26e 1047->1055 1049 dd7814-dd781b call e00237 1048->1049 1056 dd781c-dd7821 1049->1056 1054->1049 1064 dd75ab-dd75b0 1055->1064 1065 dd75b5-dd75ca call dcc4c8 1055->1065 1058 dd7829-dd782d 1056->1058 1059 dd7823-dd7824 call e05636 1056->1059 1062 dd782f-dd7832 call e05636 1058->1062 1063 dd7837-dd783c 1058->1063 1059->1058 1062->1063 1068 dd783e-dd783f call e05636 1063->1068 1069 dd7844-dd7851 call dcc1bb 1063->1069 1064->1049 1073 dd75cc-dd75d1 1065->1073 1074 dd75d6-dd75e6 call dec001 1065->1074 1068->1069 1076 dd785b-dd785f 1069->1076 1077 dd7853-dd7856 call e05636 1069->1077 1073->1049 1083 dd75e8-dd75ed 1074->1083 1084 dd75f2-dd7665 call dd5c33 1074->1084 1081 dd7869-dd786d 1076->1081 1082 dd7861-dd7864 call e05636 1076->1082 1077->1076 1086 dd786f-dd7872 call dc3a16 1081->1086 1087 dd7877-dd787f 1081->1087 1082->1081 1083->1049 1091 dd7667-dd766c 1084->1091 1092 dd7671-dd7676 1084->1092 1086->1087 1091->1049 1093 dd767d-dd7698 call dc5602 GetCurrentProcess call e00879 1092->1093 1094 dd7678 1092->1094 1098 dd769d-dd76b4 call dc827b 1093->1098 1094->1093 1101 dd76ce-dd76e5 call dc827b 1098->1101 1102 dd76b6 1098->1102 1108 dd76ee-dd76f3 1101->1108 1109 dd76e7-dd76ec 1101->1109 1103 dd76bb-dd76c9 call e00237 1102->1103 1103->1056 1110 dd774f-dd7754 1108->1110 1111 dd76f5-dd7707 call dc821f 1108->1111 1109->1103 1112 dd7774-dd777d 1110->1112 1113 dd7756-dd7768 call dc821f 1110->1113 1120 dd7709-dd770e 1111->1120 1121 dd7713-dd7723 call dc3436 1111->1121 1115 dd777f-dd7782 1112->1115 1116 dd7789-dd779d call dda50c 1112->1116 1113->1112 1127 dd776a-dd776f 1113->1127 1115->1116 1119 dd7784-dd7787 1115->1119 1129 dd779f-dd77a4 1116->1129 1130 dd77a6 1116->1130 1119->1116 1124 dd77ac-dd77af 1119->1124 1120->1049 1133 dd772f-dd7743 call dc821f 1121->1133 1134 dd7725-dd772a 1121->1134 1131 dd77b6-dd77cc call dcd5a0 1124->1131 1132 dd77b1-dd77b4 1124->1132 1127->1049 1129->1049 1130->1124 1139 dd77ce-dd77d3 1131->1139 1140 dd77d5-dd77ed call dccbc5 1131->1140 1132->1056 1132->1131 1133->1110 1141 dd7745-dd774a 1133->1141 1134->1049 1139->1049 1144 dd77ef-dd77f4 1140->1144 1145 dd77f6-dd780d call dcc8e6 1140->1145 1141->1049 1144->1049 1145->1056 1148 dd780f 1145->1148 1148->1049
                                                        Strings
                                                        • Failed to get source process folder from path., xrefs: 00DD7725
                                                        • WixBundleSourceProcessFolder, xrefs: 00DD7734
                                                        • Failed to set source process path variable., xrefs: 00DD7709
                                                        • Failed to initialize variables., xrefs: 00DD7571
                                                        • Failed to overwrite the %ls built-in variable., xrefs: 00DD76BB
                                                        • WixBundleSourceProcessPath, xrefs: 00DD76F8
                                                        • Failed to load manifest., xrefs: 00DD75E8
                                                        • Failed to extract bootstrapper application payloads., xrefs: 00DD77EF
                                                        • Failed to get manifest stream from container., xrefs: 00DD75CC
                                                        • WixBundleElevated, xrefs: 00DD76A5, 00DD76B6
                                                        • Failed to open manifest stream., xrefs: 00DD75AB
                                                        • WixBundleOriginalSource, xrefs: 00DD7759
                                                        • Failed to open attached UX container., xrefs: 00DD758E
                                                        • Failed to load catalog files., xrefs: 00DD780F
                                                        • Failed to parse command line., xrefs: 00DD7667
                                                        • Failed to set source process folder variable., xrefs: 00DD7745
                                                        • Failed to get unique temporary folder for bootstrapper application., xrefs: 00DD77CE
                                                        • Failed to initialize internal cache functionality., xrefs: 00DD779F
                                                        • WixBundleUILevel, xrefs: 00DD76D6, 00DD76E7
                                                        • Failed to set original source variable., xrefs: 00DD776A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalInitializeSection
                                                        • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                        • API String ID: 32694325-1564579409
                                                        • Opcode ID: 9aef85097d988d036c86801aa984f7560f80918586f7e0eb882ae1f3a82ae0e5
                                                        • Instruction ID: c1193ab0b9569974fee7ff67ad3d2fa25028945f91ab887a3d69ac3aa8cca55b
                                                        • Opcode Fuzzy Hash: 9aef85097d988d036c86801aa984f7560f80918586f7e0eb882ae1f3a82ae0e5
                                                        • Instruction Fuzzy Hash: 32A174B2E44616BADB129AA4CC45FEAB76CBB04700F1446A7F915F7381E730E9449BF0
                                                        Function 00DD86D0 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 209fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1254 dd86d0-dd871e CreateFileW 1255 dd8764-dd8774 call e0490d 1254->1255 1256 dd8720-dd872a GetLastError 1254->1256 1263 dd878c-dd8797 call e03edd 1255->1263 1264 dd8776-dd8787 call e00237 1255->1264 1258 dd872c-dd8735 1256->1258 1259 dd8737 1256->1259 1258->1259 1261 dd873e-dd875f call dc3821 call e00237 1259->1261 1262 dd8739 1259->1262 1276 dd8908-dd891a call dee06f 1261->1276 1262->1261 1270 dd879c-dd87a0 1263->1270 1272 dd8901-dd8902 CloseHandle 1264->1272 1273 dd87bb-dd87c0 1270->1273 1274 dd87a2-dd87b6 call e00237 1270->1274 1272->1276 1273->1272 1278 dd87c6-dd87d5 SetFilePointerEx 1273->1278 1274->1272 1281 dd880f-dd881f call e04e3a 1278->1281 1282 dd87d7-dd87e1 GetLastError 1278->1282 1291 dd882b-dd883c SetFilePointerEx 1281->1291 1292 dd8821-dd8826 1281->1292 1285 dd87ee 1282->1285 1286 dd87e3-dd87ec 1282->1286 1287 dd87f5-dd880a call dc3821 1285->1287 1288 dd87f0 1285->1288 1286->1285 1294 dd88f9-dd8900 call e00237 1287->1294 1288->1287 1295 dd883e-dd8848 GetLastError 1291->1295 1296 dd8876-dd8886 call e04e3a 1291->1296 1292->1294 1294->1272 1299 dd884a-dd8853 1295->1299 1300 dd8855 1295->1300 1296->1292 1305 dd8888-dd8898 call e04e3a 1296->1305 1299->1300 1303 dd885c-dd8871 call dc3821 1300->1303 1304 dd8857 1300->1304 1303->1294 1304->1303 1305->1292 1310 dd889a-dd88ab SetFilePointerEx 1305->1310 1311 dd88ad-dd88b7 GetLastError 1310->1311 1312 dd88e2-dd88f2 call e04e3a 1310->1312 1314 dd88b9-dd88c2 1311->1314 1315 dd88c4 1311->1315 1312->1272 1319 dd88f4 1312->1319 1314->1315 1317 dd88cb-dd88e0 call dc3821 1315->1317 1318 dd88c6 1315->1318 1317->1294 1318->1317 1319->1294
                                                        APIs
                                                        • CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00DC4DBC,?,?,00000000,00DC4DBC,00000000), ref: 00DD8713
                                                        • GetLastError.KERNEL32 ref: 00DD8720
                                                          • Part of subcall function 00E03EDD: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00E03F73
                                                        • SetFilePointerEx.KERNEL32(00000000,00E0B4B8,00000000,00000000,00000000,?,00000000,00E0B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DD87CD
                                                        • GetLastError.KERNEL32 ref: 00DD87D7
                                                        • CloseHandle.KERNELBASE(00000000,?,00000000,00E0B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DD8902
                                                        Strings
                                                        • Failed to seek to signature table in exe header., xrefs: 00DD886C
                                                        • Failed to seek to original data in exe burn section header., xrefs: 00DD88DB
                                                        • Failed to copy user from: %ls to: %ls, xrefs: 00DD87A8
                                                        • Failed to update signature offset., xrefs: 00DD8821
                                                        • Failed to create user file at path: %ls, xrefs: 00DD8751
                                                        • Failed to seek to beginning of user file: %ls, xrefs: 00DD8779
                                                        • msi.dll, xrefs: 00DD8814
                                                        • Failed to zero out original data offset., xrefs: 00DD88F4
                                                        • cache.cpp, xrefs: 00DD8744, 00DD87FB, 00DD8862, 00DD88D1
                                                        • cabinet.dll, xrefs: 00DD887B
                                                        • Failed to seek to checksum in exe header., xrefs: 00DD8805
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorLast$CloseCreateHandlePointerRead
                                                        • String ID: Failed to copy user from: %ls to: %ls$Failed to create user file at path: %ls$Failed to seek to beginning of user file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
                                                        • API String ID: 3456208997-1976062716
                                                        • Opcode ID: 1c42530ea143c26648d1ac6c02e7490918ef53b9da71d2412ece5db3df0131f2
                                                        • Instruction ID: dafa4e7c1d1cb51af1ec8a61682dffc503254c20926eda142aa3d1cc77c3b1b0
                                                        • Opcode Fuzzy Hash: 1c42530ea143c26648d1ac6c02e7490918ef53b9da71d2412ece5db3df0131f2
                                                        • Instruction Fuzzy Hash: 52519476A41236BBD7135AA49C46FBF7668EF04B10F120126FE50FB281EA21DC45A6F1
                                                        Function 00DC762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1322 dc762c-dc7edf InitializeCriticalSection 1323 dc7ee2-dc7f06 call dc5623 1322->1323 1326 dc7f08-dc7f0f 1323->1326 1327 dc7f13-dc7f24 call e00237 1323->1327 1326->1323 1328 dc7f11 1326->1328 1331 dc7f27-dc7f39 call dee06f 1327->1331 1328->1331
                                                        APIs
                                                        • InitializeCriticalSection.KERNEL32(00DD756B,00DC53BD,00000000,00DC5445), ref: 00DC764C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalInitializeSection
                                                        • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                        • API String ID: 32694325-3635313340
                                                        • Opcode ID: d622cf0e9323aa059a863d64ef9ec46e7b94551e28e487e25e7332da20aa6b04
                                                        • Instruction ID: 3aa39c2624c42b670c0bd69d68c5508d0fdfadcd4b7961e5188e00f976400a76
                                                        • Opcode Fuzzy Hash: d622cf0e9323aa059a863d64ef9ec46e7b94551e28e487e25e7332da20aa6b04
                                                        • Instruction Fuzzy Hash: FF325CB0C116299BDB65CF5AC8897CDFAB4BB89304F6092EED10CB7250C7B05AC98F55
                                                        Function 00DD82BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1334 dd82ba-dd8303 call def8e0 1337 dd847c-dd8489 call dc2195 1334->1337 1338 dd8309-dd8317 GetCurrentProcess call e00879 1334->1338 1343 dd8498-dd84aa call dee06f 1337->1343 1344 dd848b 1337->1344 1342 dd831c-dd8329 1338->1342 1345 dd832f-dd833e GetWindowsDirectoryW 1342->1345 1346 dd83b7-dd83c5 1342->1346 1347 dd8490-dd8497 call e00237 1344->1347 1349 dd8378-dd8389 call dc337f 1345->1349 1350 dd8340-dd834a GetLastError 1345->1350 1359 dd83ff-dd8411 UuidCreate 1346->1359 1360 dd83c7-dd83d1 GetLastError 1346->1360 1347->1343 1364 dd838b-dd8390 1349->1364 1365 dd8395-dd83ab call dc36a3 1349->1365 1354 dd834c-dd8355 1350->1354 1355 dd8357 1350->1355 1354->1355 1361 dd835e-dd8373 call dc3821 1355->1361 1362 dd8359 1355->1362 1366 dd841a-dd842f StringFromGUID2 1359->1366 1367 dd8413-dd8418 1359->1367 1368 dd83de 1360->1368 1369 dd83d3-dd83dc 1360->1369 1361->1347 1362->1361 1364->1347 1365->1359 1381 dd83ad-dd83b2 1365->1381 1374 dd844d-dd846e call dc1f13 1366->1374 1375 dd8431-dd844b call dc3821 1366->1375 1367->1347 1370 dd83e5-dd83fa call dc3821 1368->1370 1371 dd83e0 1368->1371 1369->1368 1370->1347 1371->1370 1384 dd8477 1374->1384 1385 dd8470-dd8475 1374->1385 1375->1347 1381->1347 1384->1337 1385->1347
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00DC5489), ref: 00DD8310
                                                          • Part of subcall function 00E00879: OpenProcessToken.ADVAPI32(?,00000008,?,00DC53BD,00000000,?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E00897
                                                          • Part of subcall function 00E00879: GetLastError.KERNEL32(?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E008A1
                                                          • Part of subcall function 00E00879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E0092B
                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00DD8336
                                                        • GetLastError.KERNEL32 ref: 00DD8340
                                                        • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00DD83BD
                                                        • GetLastError.KERNEL32 ref: 00DD83C7
                                                        • UuidCreate.RPCRT4(?), ref: 00DD8406
                                                        Strings
                                                        • Failed to convert working folder guid into string., xrefs: 00DD8446
                                                        • Failed to append bundle id on to temp path for working folder., xrefs: 00DD8470
                                                        • Failed to get temp path for working folder., xrefs: 00DD83F5
                                                        • Failed to concat Temp directory on windows path for working folder., xrefs: 00DD83AD
                                                        • Failed to get windows path for working folder., xrefs: 00DD836E
                                                        • 4#v, xrefs: 00DD83BD
                                                        • %ls%ls\, xrefs: 00DD8458
                                                        • Failed to ensure windows path for working folder ended in backslash., xrefs: 00DD838B
                                                        • Failed to create working folder guid., xrefs: 00DD8413
                                                        • Failed to copy working folder path., xrefs: 00DD848B
                                                        • cache.cpp, xrefs: 00DD8364, 00DD83EB, 00DD843C
                                                        • Temp\, xrefs: 00DD8395
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                        • String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                        • API String ID: 266130487-3587817078
                                                        • Opcode ID: 46080f4f94ed1366aee81135e71c63450a60d45d00f37e0100c2eddccd5ad8fd
                                                        • Instruction ID: fce3f8f73db9cc5c23cceba0a347cdcf0f1c092ecc95221840ff7636bb5644d8
                                                        • Opcode Fuzzy Hash: 46080f4f94ed1366aee81135e71c63450a60d45d00f37e0100c2eddccd5ad8fd
                                                        • Instruction Fuzzy Hash: AB41F976E41326BBD732A6A58C0AF9B736CAB04B10F114166BA08F7340EA75DD4496F1
                                                        Function 00DE10FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1386 de10fb-de1127 CoInitializeEx 1387 de113b-de1186 call dff483 1386->1387 1388 de1129-de1136 call e00237 1386->1388 1394 de1188-de11ab call dc3821 call e00237 1387->1394 1395 de11b0-de11d2 call dff4a4 1387->1395 1393 de139e-de13b0 call dee06f 1388->1393 1416 de1397-de1398 CoUninitialize 1394->1416 1403 de128c-de1297 SetEvent 1395->1403 1404 de11d8-de11e0 1395->1404 1407 de1299-de12a3 GetLastError 1403->1407 1408 de12d6-de12e4 WaitForSingleObject 1403->1408 1405 de138f-de1392 call dff4b4 1404->1405 1406 de11e6-de11ec 1404->1406 1405->1416 1406->1405 1410 de11f2-de11fa 1406->1410 1413 de12a5-de12ae 1407->1413 1414 de12b0 1407->1414 1411 de1318-de1323 ResetEvent 1408->1411 1412 de12e6-de12f0 GetLastError 1408->1412 1417 de11fc-de11fe 1410->1417 1418 de1274-de1287 call e00237 1410->1418 1421 de135a-de1360 1411->1421 1422 de1325-de132f GetLastError 1411->1422 1419 de12fd 1412->1419 1420 de12f2-de12fb 1412->1420 1413->1414 1423 de12b4-de12c4 call dc3821 1414->1423 1424 de12b2 1414->1424 1416->1393 1425 de1200 1417->1425 1426 de1211-de1214 1417->1426 1418->1405 1430 de12ff 1419->1430 1431 de1301-de1316 call dc3821 1419->1431 1420->1419 1427 de138a 1421->1427 1428 de1362-de1365 1421->1428 1432 de133c 1422->1432 1433 de1331-de133a 1422->1433 1446 de12c9-de12d1 call e00237 1423->1446 1424->1423 1438 de1206-de120f 1425->1438 1439 de1202-de1204 1425->1439 1442 de126e 1426->1442 1443 de1216 1426->1443 1427->1405 1440 de1386-de1388 1428->1440 1441 de1367-de1381 call dc3821 1428->1441 1430->1431 1431->1446 1435 de133e 1432->1435 1436 de1340-de1355 call dc3821 1432->1436 1433->1432 1435->1436 1436->1446 1448 de1270-de1272 1438->1448 1439->1448 1440->1405 1441->1446 1442->1448 1450 de124e-de1253 1443->1450 1451 de125c-de1261 1443->1451 1452 de121d-de1222 1443->1452 1453 de126a-de126c 1443->1453 1454 de122b-de1230 1443->1454 1455 de1239-de123e 1443->1455 1456 de1247-de124c 1443->1456 1457 de1224-de1229 1443->1457 1458 de1255-de125a 1443->1458 1459 de1232-de1237 1443->1459 1460 de1263-de1268 1443->1460 1461 de1240-de1245 1443->1461 1446->1405 1448->1403 1448->1418 1450->1418 1451->1418 1452->1418 1453->1418 1454->1418 1455->1418 1456->1418 1457->1418 1458->1418 1459->1418 1460->1418 1461->1418
                                                        APIs
                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 00DE111D
                                                        • CoUninitialize.COMBASE ref: 00DE1398
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: InitializeUninitialize
                                                        • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 3442037557-1168358783
                                                        • Opcode ID: 05de3553d92fd52d09811add7d55ed0679b4d3e81a5defdf9dcb6c387fc8d276
                                                        • Instruction ID: 78a102d59b69f3a2bd2494fa6049dbfa8b7c98762649bd58895696ec570848b4
                                                        • Opcode Fuzzy Hash: 05de3553d92fd52d09811add7d55ed0679b4d3e81a5defdf9dcb6c387fc8d276
                                                        • Instruction Fuzzy Hash: 7851383EF452E2DBCB2076978C06EBB3654AB41720B2A4335BE11FB291D6758C40C2F9
                                                        Function 00DC42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1467 dc42d7-dc432e InitializeCriticalSection * 2 call dd4d05 * 2 1472 dc4334 1467->1472 1473 dc4452-dc445c call dcb48b 1467->1473 1474 dc433a-dc4347 1472->1474 1478 dc4461-dc4465 1473->1478 1476 dc434d-dc4379 lstrlenW * 2 CompareStringW 1474->1476 1477 dc4445-dc444c 1474->1477 1479 dc43cb-dc43f7 lstrlenW * 2 CompareStringW 1476->1479 1480 dc437b-dc439e lstrlenW 1476->1480 1477->1473 1477->1474 1481 dc4474-dc447c 1478->1481 1482 dc4467-dc4473 call e00237 1478->1482 1479->1477 1483 dc43f9-dc441c lstrlenW 1479->1483 1484 dc448a-dc449f call dc3821 1480->1484 1485 dc43a4-dc43a9 1480->1485 1482->1481 1488 dc44b6-dc44d0 call dc3821 1483->1488 1489 dc4422-dc4427 1483->1489 1496 dc44a4-dc44ab 1484->1496 1485->1484 1490 dc43af-dc43bf call dc29ce 1485->1490 1488->1496 1489->1488 1493 dc442d-dc443d call dc29ce 1489->1493 1502 dc447f-dc4488 1490->1502 1503 dc43c5 1490->1503 1493->1502 1505 dc443f 1493->1505 1500 dc44ac-dc44b4 call e00237 1496->1500 1500->1481 1502->1500 1503->1479 1505->1477
                                                        APIs
                                                        • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC4303
                                                        • InitializeCriticalSection.KERNEL32(000000D0,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC430C
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC4352
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC435C
                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC4370
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC4380
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC43D0
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC43DA
                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC43EE
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00DC5266,?,?,00000000,?,?), ref: 00DC43FE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                        • String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                        • API String ID: 3039292287-3209860532
                                                        • Opcode ID: 9f88cd20cad298b5271cd8e9517e9899f64e1047ebf62a2e29ff0606d0e900ac
                                                        • Instruction ID: 922cc1b69d2ef392c5a3f4f7fa47207fec94780d46d634a7c1417326a346a277
                                                        • Opcode Fuzzy Hash: 9f88cd20cad298b5271cd8e9517e9899f64e1047ebf62a2e29ff0606d0e900ac
                                                        • Instruction Fuzzy Hash: 4351A571A44616BFCB28DB64CC56F9A776CFF04760F14411AF614E7290DBB1A990CAB0
                                                        Function 00DCC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1507 dcc28f-dcc2c1 1508 dcc32b-dcc347 GetCurrentProcess * 2 DuplicateHandle 1507->1508 1509 dcc2c3-dcc2e1 CreateFileW 1507->1509 1510 dcc349-dcc353 GetLastError 1508->1510 1511 dcc381 1508->1511 1512 dcc2e7-dcc2f1 GetLastError 1509->1512 1513 dcc383-dcc389 1509->1513 1516 dcc355-dcc35e 1510->1516 1517 dcc360 1510->1517 1511->1513 1518 dcc2fe 1512->1518 1519 dcc2f3-dcc2fc 1512->1519 1514 dcc38b-dcc391 1513->1514 1515 dcc393 1513->1515 1522 dcc395-dcc3a3 SetFilePointerEx 1514->1522 1515->1522 1516->1517 1523 dcc367-dcc37f call dc3821 1517->1523 1524 dcc362 1517->1524 1520 dcc305-dcc318 call dc3821 1518->1520 1521 dcc300 1518->1521 1519->1518 1535 dcc31d-dcc326 call e00237 1520->1535 1521->1520 1526 dcc3da-dcc3e0 1522->1526 1527 dcc3a5-dcc3af GetLastError 1522->1527 1523->1535 1524->1523 1532 dcc3fe-dcc404 1526->1532 1533 dcc3e2-dcc3e6 call de1741 1526->1533 1530 dcc3bc 1527->1530 1531 dcc3b1-dcc3ba 1527->1531 1536 dcc3be 1530->1536 1537 dcc3c3-dcc3d8 call dc3821 1530->1537 1531->1530 1541 dcc3eb-dcc3ef 1533->1541 1535->1532 1536->1537 1545 dcc3f6-dcc3fd call e00237 1537->1545 1541->1532 1542 dcc3f1 1541->1542 1542->1545 1545->1532
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00DCC47F,00DC5405,?,?,00DC5445), ref: 00DCC2D6
                                                        • GetLastError.KERNEL32(?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC2E7
                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?), ref: 00DCC336
                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC33C
                                                        • DuplicateHandle.KERNELBASE(00000000,?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC33F
                                                        • GetLastError.KERNEL32(?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC349
                                                        • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC39B
                                                        • GetLastError.KERNEL32(?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DCC3A5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                        • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                        • API String ID: 2619879409-373955632
                                                        • Opcode ID: c13eff24263d4e96f893854b57fcbb0709fb22d798a1ffa5f7c9755439b7f94b
                                                        • Instruction ID: 7ed91e5d2b76ba84a71f1994e7b398c4fc1b8c5406a47f9b465e87254d73b01e
                                                        • Opcode Fuzzy Hash: c13eff24263d4e96f893854b57fcbb0709fb22d798a1ffa5f7c9755439b7f94b
                                                        • Instruction Fuzzy Hash: 0E41D676150242ABCB219F599C49F1B3AA5EBC5720F25912DFA18AB291DB31C841DAB0
                                                        Function 00E02AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1548 e02af7-e02b17 call dc3838 1551 e02c21-e02c25 1548->1551 1552 e02b1d-e02b2b call e04a6c 1548->1552 1554 e02c27-e02c2a call e05636 1551->1554 1555 e02c2f-e02c35 1551->1555 1556 e02b30-e02b4f GetProcAddress 1552->1556 1554->1555 1558 e02b51 1556->1558 1559 e02b56-e02b6f GetProcAddress 1556->1559 1558->1559 1560 e02b71 1559->1560 1561 e02b76-e02b8f GetProcAddress 1559->1561 1560->1561 1562 e02b91 1561->1562 1563 e02b96-e02baf GetProcAddress 1561->1563 1562->1563 1564 e02bb1 1563->1564 1565 e02bb6-e02bcf GetProcAddress 1563->1565 1564->1565 1566 e02bd1 1565->1566 1567 e02bd6-e02bef GetProcAddress 1565->1567 1566->1567 1568 e02bf1 1567->1568 1569 e02bf6-e02c10 GetProcAddress 1567->1569 1568->1569 1570 e02c12 1569->1570 1571 e02c17 1569->1571 1570->1571 1571->1551
                                                        APIs
                                                          • Part of subcall function 00DC3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DC3877
                                                          • Part of subcall function 00DC3838: GetLastError.KERNEL32 ref: 00DC3881
                                                          • Part of subcall function 00E04A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00E04A9D
                                                        • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00E02B41
                                                        • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00E02B61
                                                        • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00E02B81
                                                        • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00E02BA1
                                                        • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00E02BC1
                                                        • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00E02BE1
                                                        • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00E02C01
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ErrorLast$DirectorySystem
                                                        • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                        • API String ID: 2510051996-1735120554
                                                        • Opcode ID: 233aa6e77283dad5ad346e4d0bd79857b874b529f8ae3d63f1d7346fe8e7887f
                                                        • Instruction ID: 88b7066c51e42c0b52f9027c608ff7c2cd596e26e6ee4a863062f36f4fa98d94
                                                        • Opcode Fuzzy Hash: 233aa6e77283dad5ad346e4d0bd79857b874b529f8ae3d63f1d7346fe8e7887f
                                                        • Instruction Fuzzy Hash: 2031C3B0941718EFEB219F22ED06B697BA5F714708F00223AE505765B0E7B2188EEF54
                                                        Function 00DE1741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00DCC3EB,?,00000000,?,00DCC47F), ref: 00DE1778
                                                        • GetLastError.KERNEL32(?,00DCC3EB,?,00000000,?,00DCC47F,00DC5405,?,?,00DC5445,00DC5445,00000000,?,00000000), ref: 00DE1781
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorEventLast
                                                        • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                        • API String ID: 545576003-938279966
                                                        • Opcode ID: b21c64d6939d9d0c903764661782478ea96a79d53dc53d9de92d8b4e8c33caa4
                                                        • Instruction ID: 257c7e6d6a0c48876652889580a1b7ccc69668e71f5a5f5c19e5e18c53e92bd9
                                                        • Opcode Fuzzy Hash: b21c64d6939d9d0c903764661782478ea96a79d53dc53d9de92d8b4e8c33caa4
                                                        • Instruction Fuzzy Hash: 7321D67BF41777BAD32136A75C85F6B699CEF04BA0B064225BD41BB680E670DC8085F1
                                                        Function 00DFFCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00DFFCD6
                                                        • GetProcAddress.KERNEL32(SystemFunction041), ref: 00DFFCE8
                                                        • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00DFFD2B
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DFFD3F
                                                        • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00DFFD77
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00DFFD8B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ErrorLast
                                                        • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                        • API String ID: 4214558900-3191127217
                                                        • Opcode ID: aff7e5fd9fa0b97a19cadf602f0abf8c2991d8daef840e31c83a195a41d79169
                                                        • Instruction ID: 8b918b7b0f794d96d74805ee6ba78557e0244c9a552322ab77f023058ffcf116
                                                        • Opcode Fuzzy Hash: aff7e5fd9fa0b97a19cadf602f0abf8c2991d8daef840e31c83a195a41d79169
                                                        • Instruction Fuzzy Hash: 2B2198329C133A9FC731AB57AD057266A91AF40B50F0B8235EE00FF261E7759C059AF0
                                                        Function 00DE08C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00DE08F2
                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00DE090A
                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00DE090F
                                                        • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00DE0912
                                                        • GetLastError.KERNEL32(?,?), ref: 00DE091C
                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00DE098B
                                                        • GetLastError.KERNEL32(?,?), ref: 00DE0998
                                                        Strings
                                                        • <the>.cab, xrefs: 00DE08EB
                                                        • Failed to add virtual file pointer for cab container., xrefs: 00DE0971
                                                        • cabextract.cpp, xrefs: 00DE0940, 00DE09BC
                                                        • Failed to duplicate handle to cab container., xrefs: 00DE094A
                                                        • Failed to open cabinet file: %hs, xrefs: 00DE09C9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                        • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                        • API String ID: 3030546534-3446344238
                                                        • Opcode ID: 3df20b9332e40813e8c60ef3dec753b531f678db03044f891b478ff52608eff8
                                                        • Instruction ID: ac96168973f8712dccff2c1fc874af9bd55253f02f2baf9cb64560d78af46db7
                                                        • Opcode Fuzzy Hash: 3df20b9332e40813e8c60ef3dec753b531f678db03044f891b478ff52608eff8
                                                        • Instruction Fuzzy Hash: C631E372942636BBEA216E969C49F9F7E68FF04760F190121FE04B7252D7619D80CAF0
                                                        Function 00DD6A57 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00DC4E11,?,?), ref: 00DD6A77
                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?,00DC4E11,?,?), ref: 00DD6A7D
                                                        • DuplicateHandle.KERNELBASE(00000000,?,?,00DC4E11,?,?), ref: 00DD6A80
                                                        • GetLastError.KERNEL32(?,?,00DC4E11,?,?), ref: 00DD6A8A
                                                        • CloseHandle.KERNEL32(000000FF,?,00DC4E11,?,?), ref: 00DD6B03
                                                        Strings
                                                        • Failed to append the file handle to the command line., xrefs: 00DD6AEB
                                                        • burn.filehandle.attached, xrefs: 00DD6AD0
                                                        • Failed to duplicate file handle for attached container., xrefs: 00DD6AB8
                                                        • core.cpp, xrefs: 00DD6AAE
                                                        • %ls -%ls=%u, xrefs: 00DD6AD7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentHandleProcess$CloseDuplicateErrorLast
                                                        • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
                                                        • API String ID: 4224961946-4196573879
                                                        • Opcode ID: 57635f082910ce1c6ed5b3731e7f335666ba1b53481124d19eecbb50ee7ad420
                                                        • Instruction ID: 7e2914f41dc76d05fb41d966383f61fa66ab9b437ec7294e718427b976a9671f
                                                        • Opcode Fuzzy Hash: 57635f082910ce1c6ed5b3731e7f335666ba1b53481124d19eecbb50ee7ad420
                                                        • Instruction Fuzzy Hash: 63117232A41226FBCB11ABA58C05E9E7B68AF45730F115256F960F73D0D771DD4086E0
                                                        Function 00E032F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00E03309
                                                        • SysAllocString.OLEAUT32(?), ref: 00E03325
                                                        • VariantClear.OLEAUT32(?), ref: 00E033AC
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E033B7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: StringVariant$AllocClearFreeInit
                                                        • String ID: `Dv$xmlutil.cpp
                                                        • API String ID: 760788290-2876128059
                                                        • Opcode ID: 8368035962b42e1c0e86bc8dcf65554509a0906ab9d75a488d4071d2aa58faca
                                                        • Instruction ID: ed9ba617e64b237561cc4a7ad620c3496a9deb5d5f34d1225ab8c9a3400bfb8d
                                                        • Opcode Fuzzy Hash: 8368035962b42e1c0e86bc8dcf65554509a0906ab9d75a488d4071d2aa58faca
                                                        • Instruction Fuzzy Hash: 7F21A331901219EFCB21DFA5C888FAEBBBDEF44B15F154158F911BB250CB359E848B90
                                                        Function 00E00879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenProcessToken.ADVAPI32(?,00000008,?,00DC53BD,00000000,?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E00897
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E008A1
                                                        • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E008D3
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E008EC
                                                        • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00DD769D,00000000), ref: 00E0092B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                        • String ID: procutil.cpp
                                                        • API String ID: 4040495316-1178289305
                                                        • Opcode ID: 095f73eb276d8d01f4475332b6f8a6afc9d82de73cd9176f07c16e0352f5df4f
                                                        • Instruction ID: 12fd54d02c1470aa6cab9bfcd3d238e7c03b4ec0e69d5b3b7a8b64c460be4ad4
                                                        • Opcode Fuzzy Hash: 095f73eb276d8d01f4475332b6f8a6afc9d82de73cd9176f07c16e0352f5df4f
                                                        • Instruction Fuzzy Hash: 2A21A432D40229EFD7219B958805B9EBBA8FF90710F118166AD54FB290D3718E84DAE0
                                                        Function 00DD6B13 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00DD6B49
                                                        • CloseHandle.KERNEL32(00000000), ref: 00DD6BB9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateFileHandle
                                                        • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
                                                        • API String ID: 3498533004-3263533295
                                                        • Opcode ID: 44dd391eb9ed1012b39e2a97a399ee76dd4468035c67aa36f568fcb4b56fc4ab
                                                        • Instruction ID: 723130d26e1e011f0c1e1a50617ad7d7c560a7e14c15e729486f0cf057fa8d80
                                                        • Opcode Fuzzy Hash: 44dd391eb9ed1012b39e2a97a399ee76dd4468035c67aa36f568fcb4b56fc4ab
                                                        • Instruction Fuzzy Hash: DA11B132600714BBDB205A68CC05F9B7BA8EB85B30F164356F929FB2E1D3B0985186E1
                                                        Function 00E03565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32(00000000), ref: 00E03574
                                                        • InterlockedIncrement.KERNEL32(00E2B6C8), ref: 00E03591
                                                        • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00E2B6B8,?,?,?,?,?,?), ref: 00E035AC
                                                        • CLSIDFromProgID.OLE32(MSXML.DOMDocument,00E2B6B8,?,?,?,?,?,?), ref: 00E035B8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FromProg$IncrementInitializeInterlocked
                                                        • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                        • API String ID: 2109125048-2356320334
                                                        • Opcode ID: e794d9bf877ee665239f036965a263eae50b4742a90179b11efbedf5abd73d1c
                                                        • Instruction ID: 27713c5441ad85bf6a2ab95ef7d51117efd6068a4e335c708aa7be7c8bd6ad34
                                                        • Opcode Fuzzy Hash: e794d9bf877ee665239f036965a263eae50b4742a90179b11efbedf5abd73d1c
                                                        • Instruction Fuzzy Hash: F2F065307502369FD3211B737D09B572E6DEB81B59F142529E840F61F4D7A0D9C586B0
                                                        Function 00E04A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00E04A9D
                                                        • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00E04ACA
                                                        • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00E04AF6
                                                        • GetLastError.KERNEL32(00000000,00E0B7A0,?,00000000,?,00000000,?,00000000), ref: 00E04B34
                                                        • GlobalFree.KERNEL32(00000000), ref: 00E04B65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Global$AllocFree
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 1145190524-2967768451
                                                        • Opcode ID: 11f8d2df8903eec7ed11df26d31541cda10d0702323cf8b8c844559c1217a6e3
                                                        • Instruction ID: d1f42384fda70a853bf93ac3bf45c07ff7c3d38484c743fc47242fa6002e39d8
                                                        • Opcode Fuzzy Hash: 11f8d2df8903eec7ed11df26d31541cda10d0702323cf8b8c844559c1217a6e3
                                                        • Instruction Fuzzy Hash: B631C7F6E40229ABC7129A998D41FAFBAB8EF44750F115255FE14F72C1E731DC408AE0
                                                        Function 00DE0A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00DE0B27
                                                        • GetLastError.KERNEL32(?,?,?), ref: 00DE0B31
                                                        Strings
                                                        • Failed to move file pointer 0x%x bytes., xrefs: 00DE0B62
                                                        • cabextract.cpp, xrefs: 00DE0B55
                                                        • Invalid seek type., xrefs: 00DE0ABD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                        • API String ID: 2976181284-417918914
                                                        • Opcode ID: 9805b581d3eb0128c531387f6a37dd27af94217a8e1ddb244100fef817536aa7
                                                        • Instruction ID: 70c85d536223a84184f06a4e2a7c37eddd04dbc37067c286f614597afbda401b
                                                        • Opcode Fuzzy Hash: 9805b581d3eb0128c531387f6a37dd27af94217a8e1ddb244100fef817536aa7
                                                        • Instruction Fuzzy Hash: 40319671A4025AEFCB11EF99D845EAEBB65FF04724B188225FD14A7251D370ED90CBB0
                                                        Function 00DC4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?), ref: 00DC4123
                                                        • GetLastError.KERNEL32(?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?,00000000,00000000), ref: 00DC4131
                                                        • CreateDirectoryW.KERNEL32(?,840F01E8,00DC5489,?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?,00000000), ref: 00DC419A
                                                        • GetLastError.KERNEL32(?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?,00000000,00000000), ref: 00DC41A4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectoryErrorLast
                                                        • String ID: dirutil.cpp
                                                        • API String ID: 1375471231-2193988115
                                                        • Opcode ID: c7cb14fb1433036d7d55f76349fa869558215d0906b5d825ece630a4ba7f0896
                                                        • Instruction ID: e507ba63e048da16fb9443a4dc84cc5ebb43538ef2908f44b8bddac78a8d8145
                                                        • Opcode Fuzzy Hash: c7cb14fb1433036d7d55f76349fa869558215d0906b5d825ece630a4ba7f0896
                                                        • Instruction Fuzzy Hash: A611D236A003379ADB321AA64C64F7BA654EF75B61F1D4029FDC4EB250E3608CD092F1
                                                        Function 00DC56A9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00DC6595,00DC6595,?,00DC563D,?,?,00000000), ref: 00DC56E5
                                                        • GetLastError.KERNEL32(?,00DC563D,?,?,00000000,?,?,00DC6595,?,00DC7F02,?,?,?,?,?), ref: 00DC5714
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareErrorLastString
                                                        • String ID: Failed to compare strings.$variable.cpp$version.dll
                                                        • API String ID: 1733990998-4228644734
                                                        • Opcode ID: 7a53257f43ce26b547f9d5160edc0d241d8465074c6a144642f27323d70174d3
                                                        • Instruction ID: b2294fdb54a70aa1a6c310704adc24bfe2396a2493fa4efc914c1828c55ae466
                                                        • Opcode Fuzzy Hash: 7a53257f43ce26b547f9d5160edc0d241d8465074c6a144642f27323d70174d3
                                                        • Instruction Fuzzy Hash: F1212532640A16EFC7108F98DD40F5AB7A4EB05720B24031CE925AB3C4EA30FD8186B0
                                                        Function 00E00A28 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00DC4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00E00A38
                                                        • GetLastError.KERNEL32(?,?,00DC4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00E00A46
                                                        • GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 00E00A8B
                                                        • GetLastError.KERNEL32(?,?,00DC4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00E00A95
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeExitObjectProcessSingleWait
                                                        • String ID: procutil.cpp
                                                        • API String ID: 590199018-1178289305
                                                        • Opcode ID: 316b4ae6d638e0d23b37f85cff87f6d9d01da3d1b963bd939e67949e5872fd96
                                                        • Instruction ID: 604321cae2a2976cdd9c10f5e6c313383fdeaa1df0d5114bce615b942211e172
                                                        • Opcode Fuzzy Hash: 316b4ae6d638e0d23b37f85cff87f6d9d01da3d1b963bd939e67949e5872fd96
                                                        • Instruction Fuzzy Hash: 02117037E41336EBCB219B959908B9F7AB4EB04760F129255ED54BB3D0E2318E8096D1
                                                        Function 00DE09EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DE140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00DE0A19,?,?,?), ref: 00DE1434
                                                          • Part of subcall function 00DE140C: GetLastError.KERNEL32(?,00DE0A19,?,?,?), ref: 00DE143E
                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00DE0A27
                                                        • GetLastError.KERNEL32 ref: 00DE0A31
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00DE0A55
                                                        • Failed to read during cabinet extraction., xrefs: 00DE0A5F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$PointerRead
                                                        • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                        • API String ID: 2170121939-2426083571
                                                        • Opcode ID: 8562f1b57706340d4674359355f43a24d1ca21cc19067cc103511891274ca483
                                                        • Instruction ID: 177ebc98a97bfab68d53f4121d59de6328102301003119289868c80008ff4864
                                                        • Opcode Fuzzy Hash: 8562f1b57706340d4674359355f43a24d1ca21cc19067cc103511891274ca483
                                                        • Instruction Fuzzy Hash: AC118E76A0126ABBCB21AF96DC04E9A7F68FF04760B154165FD04B7291D7319950C6F0
                                                        Function 00DE140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00DE0A19,?,?,?), ref: 00DE1434
                                                        • GetLastError.KERNEL32(?,00DE0A19,?,?,?), ref: 00DE143E
                                                        Strings
                                                        • Failed to move to virtual file pointer., xrefs: 00DE146C
                                                        • cabextract.cpp, xrefs: 00DE1462
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                        • API String ID: 2976181284-3005670968
                                                        • Opcode ID: bc3025bc40d4874a67a66ee3ecc3802cc8c32297805d403045d8c467e907f2d0
                                                        • Instruction ID: 162a22e1403cb47410bfbeb47bcfa08ce377d4a9e14a6f50f9936449e805eae4
                                                        • Opcode Fuzzy Hash: bc3025bc40d4874a67a66ee3ecc3802cc8c32297805d403045d8c467e907f2d0
                                                        • Instruction Fuzzy Hash: AD018F3BA4167ABBC7226A979C08E9BBB24FF407707158125FD186A291D7319850C6E0
                                                        Function 00E03EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00E03F73
                                                        • GetLastError.KERNEL32 ref: 00E03FD6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastRead
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 1948546556-2967768451
                                                        • Opcode ID: e3e02c6b209c479ab8dcf201402636593e6c30c2f6cf628478cee2e75ae455fd
                                                        • Instruction ID: 7d556956bd6dd7a902d04aa92208f5c768e40aced56e2284b0feb989fcc4e0bf
                                                        • Opcode Fuzzy Hash: e3e02c6b209c479ab8dcf201402636593e6c30c2f6cf628478cee2e75ae455fd
                                                        • Instruction Fuzzy Hash: 1B318071E0026A9FDB21CF65C940BDA77B8FB04751F0051AAFA48F7280D7B49EC48BA1
                                                        Function 00E04E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00E03F9A,?,?,?), ref: 00E04E5E
                                                        • GetLastError.KERNEL32(?,?,00E03F9A,?,?,?), ref: 00E04E68
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastWrite
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 442123175-2967768451
                                                        • Opcode ID: bb388d1dba4f228ff179caf31e684b7232037d1dc3a3cbe9ed1ebf17cd33f8fc
                                                        • Instruction ID: 1f4e177840a1a08418e166e1bfeda3a070d9d6a3a49371ad4d1ab68e16d3b6b3
                                                        • Opcode Fuzzy Hash: bb388d1dba4f228ff179caf31e684b7232037d1dc3a3cbe9ed1ebf17cd33f8fc
                                                        • Instruction Fuzzy Hash: 2EF04BB3A01229ABC7218A9ADD45ADBBB6DFB44761F010215BE04FB180D721AE4186E0
                                                        Function 00E0490D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00DD8770,00000000,00000000,00000000,00000000,00000000), ref: 00E04925
                                                        • GetLastError.KERNEL32(?,?,?,00DD8770,00000000,00000000,00000000,00000000,00000000), ref: 00E0492F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 2976181284-2967768451
                                                        • Opcode ID: eed78f1a92e978ba6d757c6e2944ce8d884e11ec6a9d27b196be9e2a1db342bc
                                                        • Instruction ID: 59c22497af10a52f16674519dc017442eab94ba237e53ca931c33ef4154974fa
                                                        • Opcode Fuzzy Hash: eed78f1a92e978ba6d757c6e2944ce8d884e11ec6a9d27b196be9e2a1db342bc
                                                        • Instruction Fuzzy Hash: E3F086B6A0012EABDB118F85DD05EAB7FA8EF44760B014164BE44BB291E731DD50D7E0
                                                        Function 00DC3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DC3877
                                                        • GetLastError.KERNEL32 ref: 00DC3881
                                                        • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00DC38EA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: DirectoryErrorLastLibraryLoadSystem
                                                        • String ID:
                                                        • API String ID: 1230559179-0
                                                        • Opcode ID: c189934a28f1722353fe92a6d657eafb6cfc69105f913d23211a42fc64b1c061
                                                        • Instruction ID: 8cf4e3b526903a8d3cf1584c22254bbb3bfb2498ec0195ee3b71d1e0a91ad794
                                                        • Opcode Fuzzy Hash: c189934a28f1722353fe92a6d657eafb6cfc69105f913d23211a42fc64b1c061
                                                        • Instruction Fuzzy Hash: 2821F5B6D0133EABDB209B658C45F9A77A8EF44710F1541A9BE14FB241DA70DE448BF0
                                                        Function 00DC3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00DC3BB6,00000000,?,00DC1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DC13B8), ref: 00DC3A20
                                                        • RtlFreeHeap.NTDLL(00000000,?,00DC3BB6,00000000,?,00DC1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DC13B8,000001C7,00000100), ref: 00DC3A27
                                                        • GetLastError.KERNEL32(?,00DC3BB6,00000000,?,00DC1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DC13B8,000001C7,00000100,?), ref: 00DC3A31
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$ErrorFreeLastProcess
                                                        • String ID:
                                                        • API String ID: 406640338-0
                                                        • Opcode ID: 28286d8663f3311d0bae6637178a32d210c5bc260206cfa3f885799a663bda04
                                                        • Instruction ID: 9fe75fd7bcfc38435df173e836bf1e2a05e1c8ccc847fae322f8a0e3dfe4e185
                                                        • Opcode Fuzzy Hash: 28286d8663f3311d0bae6637178a32d210c5bc260206cfa3f885799a663bda04
                                                        • Instruction Fuzzy Hash: B1D0C233A0113A9BC32017E75C0CA5B7E5CFF04AA17054024FD44E7220D722CC5082E0
                                                        Function 00DFF49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DFF491
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: 0ad41cbd960acf29b19ece2b3e09795eeec2d7e0ae4508095f9aed610477fc69
                                                        • Instruction ID: 8c4c32c51e53168bf68f0169e16efbb9c79175a1d2ba02c6bbf27f3612bdebfc
                                                        • Opcode Fuzzy Hash: 0ad41cbd960acf29b19ece2b3e09795eeec2d7e0ae4508095f9aed610477fc69
                                                        • Instruction Fuzzy Hash: 6AB012A226A511AE724456153E03C37015CC6D6F22371E57EF080E1092EC444C814032
                                                        Function 00DFF4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DFF491
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: a6920359709c3536f1a530f849c89d1898d0f271281c8faffb1e79619e951715
                                                        • Instruction ID: b54bb9ac47d04474c2a5c7c0e61b7385ebcdad393fd4343bae7d63ff331852a2
                                                        • Opcode Fuzzy Hash: a6920359709c3536f1a530f849c89d1898d0f271281c8faffb1e79619e951715
                                                        • Instruction Fuzzy Hash: BAB012A226A651AD724457153D03C37015CC6D5F22371E67EF080E1092EC404CC04032
                                                        Function 00DFF479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00DFF491
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: 779783c08a30b149bd5323f7ba56190299690fc589771465b319713d0fe1a580
                                                        • Instruction ID: 7578665c58ab39d5d440e130676e9d5278630f2c5bd02dbfd5c0b9764f909735
                                                        • Opcode Fuzzy Hash: 779783c08a30b149bd5323f7ba56190299690fc589771465b319713d0fe1a580
                                                        • Instruction Fuzzy Hash: F7B012A626A511BD720416113D03C37011CC6D1F22371E67EF480F0092AC404C808032
                                                        Function 00DC3AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(?,000001C7,?,?,00DC226D,?,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000), ref: 00DC3B04
                                                        • RtlReAllocateHeap.NTDLL(00000000,?,00DC226D,?,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3B0B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID:
                                                        • API String ID: 1357844191-0
                                                        • Opcode ID: 9f6c0a6ec45a7410d9b017a7c1a03a270167b6f878378cb3eafce63956d28f7f
                                                        • Instruction ID: 1f9af973529a6a9a813980fde8010de7e5bbf0ab2ab607589173ee4350b14b49
                                                        • Opcode Fuzzy Hash: 9f6c0a6ec45a7410d9b017a7c1a03a270167b6f878378cb3eafce63956d28f7f
                                                        • Instruction Fuzzy Hash: CDD0C93215420DEFCF005FE9DC0DDAA3BACFB586027048405B915D2220C73AE4A49A60
                                                        Function 00E035C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 00E035F8
                                                          • Part of subcall function 00E0304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00E03609,00000000,?,00000000), ref: 00E03069
                                                          • Part of subcall function 00E0304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00DEC025,?,00DC5405,?,00000000,?), ref: 00E03075
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorHandleInitLastModuleVariant
                                                        • String ID:
                                                        • API String ID: 52713655-0
                                                        • Opcode ID: c48504e752059083bfa68ee40e23e4ca9b338baa2f5c9c58e4889939acd23654
                                                        • Instruction ID: 2fa5fa7b838b6feb4d9781bc0caddcc4a76ca8cfbf51dece3b2c31edef3be64a
                                                        • Opcode Fuzzy Hash: c48504e752059083bfa68ee40e23e4ca9b338baa2f5c9c58e4889939acd23654
                                                        • Instruction Fuzzy Hash: 13315E76E00229AFCB11DFA9D884ADEB7F8EF08710F01556AED05BB351D7759D408BA0
                                                        Function 00DF5305 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00DF6213,00000001,00000364), ref: 00DF5346
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: e0ff3747932bf7d6d30af6d1653a246d7bc6443dc45d442511d99900cdff0ebe
                                                        • Instruction ID: 8e54668ada807be84b5994bf2ae0a0256e855c0025d266cf4b296a7108d8bf44
                                                        • Opcode Fuzzy Hash: e0ff3747932bf7d6d30af6d1653a246d7bc6443dc45d442511d99900cdff0ebe
                                                        • Instruction Fuzzy Hash: 5DF0BB3250192D6ADB211B6A6C05B7737C9AF417E0F1FD121BF15A6159CBB0EC4042F0
                                                        Function 00DC34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00DD8BD3,0000001C,80070490,00000000,00000000,80070490), ref: 00DC34D5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FolderPath
                                                        • String ID:
                                                        • API String ID: 1514166925-0
                                                        • Opcode ID: ac0a6e0c527f16dac5154e4894dc33c87933773692a09bfd1773732467b8d3dc
                                                        • Instruction ID: a269a9ed05223c41e636660461f8cf46c49043e961a2630216519625b4db6494
                                                        • Opcode Fuzzy Hash: ac0a6e0c527f16dac5154e4894dc33c87933773692a09bfd1773732467b8d3dc
                                                        • Instruction Fuzzy Hash: 49E012722012257BE6022E615C05EAB7B5CEF053547008059FE40D7011D776E95087B0
                                                        Function 00E02EFE Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FreeLibrary.KERNELBASE(00000000,00000000,00DC556E,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E02F0B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeLibrary
                                                        • String ID:
                                                        • API String ID: 3664257935-0
                                                        • Opcode ID: e6f548dac6703d54da7db440546e7386d3564c6ff714d97fbf037cdad964ff12
                                                        • Instruction ID: ab39af6877b18645f8b0d1679487ed11ab0ca6d3a6c2993d7ca3c8ad2c6f2bec
                                                        • Opcode Fuzzy Hash: e6f548dac6703d54da7db440546e7386d3564c6ff714d97fbf037cdad964ff12
                                                        • Instruction Fuzzy Hash: 5AE0F6B1926625DECB208F6BBD444427BB8F718B40304422BB906F2220C7B1948B8FE0
                                                        Function 00E09684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00E0966B
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: f92b209da7ee9a1c60ba7a4405832093fafedc880b97b611842fbfdd4f8df57b
                                                        • Instruction ID: 852be89a28e8e98087d5007c3453213cbe6fad39375f4f90eef9d1520b3c9613
                                                        • Opcode Fuzzy Hash: f92b209da7ee9a1c60ba7a4405832093fafedc880b97b611842fbfdd4f8df57b
                                                        • Instruction Fuzzy Hash: D0B012D2269312ADBA4855453F43C37029CC6C1F11370B12EB000F21D3E8450CC10132
                                                        Function 00E09674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00E0966B
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: eb082787206310361c7b5a55466ae72abe230c980764192bce90348b34351d23
                                                        • Instruction ID: 60b70eda41c0d90f80f1567141136c0c77172f74c686c9ad21c131b662a66363
                                                        • Opcode Fuzzy Hash: eb082787206310361c7b5a55466ae72abe230c980764192bce90348b34351d23
                                                        • Instruction Fuzzy Hash: 9AB012D2269113ADB64865053D03C37029CC2C0B11370F12EB400F11D3E8400CC44132
                                                        Function 00E09653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 00E0966B
                                                          • Part of subcall function 00E0998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E09A09
                                                          • Part of subcall function 00E0998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E09A1A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: 1fc84487cb924c48b6f5bbca9da6733f45d1102cc9fc03a985428e5dbb8021e1
                                                        • Instruction ID: a63a6e7192f7a62c992314ead7f683f8845395d9e3a6d1ac553d81aa9aeb9cc0
                                                        • Opcode Fuzzy Hash: 1fc84487cb924c48b6f5bbca9da6733f45d1102cc9fc03a985428e5dbb8021e1
                                                        • Instruction Fuzzy Hash: 4FB012D2269212BDBA0815017D83C37025CC6C0F11370F12EB000F10D3A8400CC00233
                                                        Function 00DC14B6 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00DC21A8,?,00000000,?,00000000,?,00DC390C,00000000,?,00000104), ref: 00DC14E8
                                                          • Part of subcall function 00DC3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BDB
                                                          • Part of subcall function 00DC3BD3: HeapSize.KERNEL32(00000000,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BE2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$ProcessSizelstrlen
                                                        • String ID:
                                                        • API String ID: 3492610842-0
                                                        • Opcode ID: 56b9017bb04e3e9824157c1b6aa1c3797efaa616e7611f011a60c053cc589497
                                                        • Instruction ID: 499bb341aa0d5361485d4165ac2e6caae6a3b3cfa362c7ec3bc8e0055352a299
                                                        • Opcode Fuzzy Hash: 56b9017bb04e3e9824157c1b6aa1c3797efaa616e7611f011a60c053cc589497
                                                        • Instruction Fuzzy Hash: C101F93B21023AABCF115E54DC80F9A77B6AF86760F65821DFA165B253D632DC4086B0

                                                        Non-executed Functions

                                                        Function 00DCA8F1 Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(?), ref: 00DCB11C
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00E0CA9C,000000FF,DirectorySearch,000000FF,00E0CA9C,Condition,feclient.dll,00E0CA9C,Variable,?,00E0CA9C,00E0CA9C,?,?), ref: 00DCAA29
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 00DCAA7E
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 00DCAA9A
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 00DCAABE
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 00DCAB11
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00DCAB2B
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 00DCAB53
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 00DCAB91
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 00DCABB0
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 00DCABCF
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 00DCAC8D
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 00DCACA7
                                                          • Part of subcall function 00E032F3: VariantInit.OLEAUT32(?), ref: 00E03309
                                                          • Part of subcall function 00E032F3: SysAllocString.OLEAUT32(?), ref: 00E03325
                                                          • Part of subcall function 00E032F3: VariantClear.OLEAUT32(?), ref: 00E033AC
                                                          • Part of subcall function 00E032F3: SysFreeString.OLEAUT32(00000000), ref: 00E033B7
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 00DCAD06
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 00DCAD28
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00DCAD48
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 00DCAE20
                                                        • SysFreeString.OLEAUT32(?), ref: 00DCAFFE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
                                                        • String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$`Dv$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
                                                        • API String ID: 2748437055-331518940
                                                        • Opcode ID: c06ce6acb9a1a8df78ec488ac4744c193abc02541c37d07957343da3a91cf25b
                                                        • Instruction ID: 0dc12e62a8dce9987cd626926fa23885e6d9b37a74d9c7e1a4c44fdd2e0b917a
                                                        • Opcode Fuzzy Hash: c06ce6acb9a1a8df78ec488ac4744c193abc02541c37d07957343da3a91cf25b
                                                        • Instruction Fuzzy Hash: B8229635D4832BBADB219AA48C43F6E7A64AB02734F345729F530B72D0D771DD80DAA1
                                                        Function 00DE41EA Relevance: 43.0, Strings: 34, Instructions: 498COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • VersionString, xrefs: 00DE428E, 00DE42EF
                                                        • REINSTALL=ALL, xrefs: 00DE45D3, 00DE464D
                                                        • Failed to add reboot suppression property on uninstall., xrefs: 00DE477D
                                                        • Failed to add feature action properties to argument string., xrefs: 00DE44B9
                                                        • Failed to uninstall MSI package., xrefs: 00DE47EF
                                                        • REBOOT=ReallySuppress, xrefs: 00DE45A0, 00DE476C
                                                        • Failed to enable logging for package: %ls to: %ls, xrefs: 00DE441F
                                                        • Failed to add patch properties to argument string., xrefs: 00DE44FD
                                                        • Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 00DE460C
                                                        • crypt32.dll, xrefs: 00DE440A
                                                        • REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 00DE45F5
                                                        • Failed to add ADMIN property on admin install., xrefs: 00DE471E
                                                        • WixBundleExecutePackageCacheFolder, xrefs: 00DE436A, 00DE48A4
                                                        • Failed to add obfuscated properties to argument string., xrefs: 00DE4497
                                                        • Failed to add reboot suppression property on install., xrefs: 00DE45BB
                                                        • Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 00DE469B
                                                        • Failed to add properties to argument string., xrefs: 00DE4463
                                                        • Failed to perform minor upgrade of MSI package., xrefs: 00DE4638
                                                        • %ls %ls=ALL, xrefs: 00DE46B6, 00DE4795
                                                        • Failed to install MSI package., xrefs: 00DE4746
                                                        • Failed to initialize external UI handler., xrefs: 00DE43F4
                                                        • Failed to add reinstall all property on minor upgrade., xrefs: 00DE45EA
                                                        • IGNOREDEPENDENCIES, xrefs: 00DE46A5, 00DE4784
                                                        • ACTION=ADMIN, xrefs: 00DE4709
                                                        • Failed to get cached path for package: %ls, xrefs: 00DE434F
                                                        • Failed to add patch properties to obfuscated argument string., xrefs: 00DE451F
                                                        • Failed to add feature action properties to obfuscated argument string., xrefs: 00DE44DB
                                                        • Failed to add the list of dependencies to ignore to the properties., xrefs: 00DE46CA
                                                        • WixBundleExecutePackageAction, xrefs: 00DE43B7, 00DE48B4
                                                        • Failed to run maintanance mode for MSI package., xrefs: 00DE46F6
                                                        • Failed to build MSI path., xrefs: 00DE439D
                                                        • msasn1.dll, xrefs: 00DE440B
                                                        • feclient.dll, xrefs: 00DE42C5, 00DE434D, 00DE441D, 00DE454B, 00DE47D8
                                                        • %ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 00DE4687
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
                                                        • API String ID: 0-2033600224
                                                        • Opcode ID: 210b4772f82d6cf96d057734bab85293c657fff7fba9292d1cbdf3d28f2497c4
                                                        • Instruction ID: 0ab92ae9ac8fccfae0b6fe9256b7d2e6c83affe8180258b7af58a2de619965de
                                                        • Opcode Fuzzy Hash: 210b4772f82d6cf96d057734bab85293c657fff7fba9292d1cbdf3d28f2497c4
                                                        • Instruction Fuzzy Hash: 0302BF71940665AFDB21BE56CC81FA9B6AAFF44700F0401A5F908B7251D772EEA0CBE0
                                                        Function 00E01719 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00E017B1
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E017BB
                                                        • CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00E01808
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E0180E
                                                        • CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00E01848
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E0184E
                                                        • CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00E0188E
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E01894
                                                        • CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00E018D4
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E018DA
                                                        • CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00E0191A
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E01920
                                                        • SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00E01A11
                                                        • SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00E01A4B
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E01A55
                                                        • SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00E01A8D
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E01A97
                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00E01AD0
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E01ADA
                                                        • CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00E01B18
                                                        • LocalFree.KERNEL32(?), ref: 00E01B2E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
                                                        • String ID: srputil.cpp
                                                        • API String ID: 267631441-4105181634
                                                        • Opcode ID: 7f79198f6cb0d7f926e7a791c88e37932d6552a5ac050abd68fbfcef1ab79098
                                                        • Instruction ID: 5bf7993f73fadd9ef0ddeb10cf73f267fb6d442eaaf4fd50459f05128eebdc81
                                                        • Opcode Fuzzy Hash: 7f79198f6cb0d7f926e7a791c88e37932d6552a5ac050abd68fbfcef1ab79098
                                                        • Instruction Fuzzy Hash: 02C14776D4123D9BD7318F969C48BDFFAB8BF44750F0141AAA945FB240D7709E848EA0
                                                        Function 00DEC332 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 376COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00DEC385
                                                        • Failed to allocate memory for pseudo bundle payload hash., xrefs: 00DEC4AD
                                                        • Failed to append relation type to repair arguments for related bundle package, xrefs: 00DEC5F1
                                                        • Failed to copy filename for pseudo bundle., xrefs: 00DEC417
                                                        • Failed to copy cache id for pseudo bundle., xrefs: 00DEC55F
                                                        • Failed to copy repair arguments for related bundle package, xrefs: 00DEC5D0
                                                        • Failed to copy install arguments for related bundle package, xrefs: 00DEC584
                                                        • Failed to append relation type to install arguments for related bundle package, xrefs: 00DEC5A9
                                                        • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00DEC3BE
                                                        • -%ls, xrefs: 00DEC34C
                                                        • Failed to copy download source for pseudo bundle., xrefs: 00DEC469
                                                        • Failed to copy local source path for pseudo bundle., xrefs: 00DEC43B
                                                        • Failed to copy key for pseudo bundle., xrefs: 00DEC542
                                                        • Failed to copy key for pseudo bundle payload., xrefs: 00DEC3F3
                                                        • pseudobundle.cpp, xrefs: 00DEC379, 00DEC3B2, 00DEC4A1, 00DEC6D2
                                                        • Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00DEC644
                                                        • Failed to copy version for pseudo bundle., xrefs: 00DEC72D
                                                        • Failed to allocate memory for dependency providers., xrefs: 00DEC6DE
                                                        • Failed to copy display name for pseudo bundle., xrefs: 00DEC74F
                                                        • Failed to copy uninstall arguments for related bundle package, xrefs: 00DEC623
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
                                                        • API String ID: 1357844191-2832335422
                                                        • Opcode ID: ba1fb1de9c9f75ff0a4722e759e3ea7c802ef1f4663dc8dd064efb83e3ebb063
                                                        • Instruction ID: 56438bad415c162028d4373d60181e4d42e72a91597e70a142428501fb4c5412
                                                        • Opcode Fuzzy Hash: ba1fb1de9c9f75ff0a4722e759e3ea7c802ef1f4663dc8dd064efb83e3ebb063
                                                        • Instruction Fuzzy Hash: 1EC1C071620796ABCB25EF25C881F6A77A9FF08710B046129FD05EB251DB70EC529BF0
                                                        Function 00DC45EE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 141sleepshutdownCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00DC4617
                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DC461E
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DC4628
                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00DC4678
                                                        • GetLastError.KERNEL32 ref: 00DC4682
                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00DC46C6
                                                        • GetLastError.KERNEL32 ref: 00DC46D0
                                                        • Sleep.KERNEL32(000003E8), ref: 00DC470C
                                                        • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00DC471D
                                                        • GetLastError.KERNEL32 ref: 00DC4727
                                                        • CloseHandle.KERNEL32(?), ref: 00DC477D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
                                                        • String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$user.cpp
                                                        • API String ID: 2241679041-1583736410
                                                        • Opcode ID: 58f0e92a985ccc44566a0e0adaffdc916bb85110b88e64c4e6f38fbfe2682ec3
                                                        • Instruction ID: 97f14767bd235f29ea864a5b971b977dd45ff253551c5f7b26a86a4ab49ecc72
                                                        • Opcode Fuzzy Hash: 58f0e92a985ccc44566a0e0adaffdc916bb85110b88e64c4e6f38fbfe2682ec3
                                                        • Instruction Fuzzy Hash: CF41D572A80227ABD7215BA58D56FAF7A68FB01760F154129BE01B72C0D7658C4486F1
                                                        Function 00DD4EDF Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 165pipeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00DD4F0D
                                                        • GetLastError.KERNEL32(?,00000000,?,?,00DC452F,?), ref: 00DD4F16
                                                        • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,00DC452F,?), ref: 00DD4FB8
                                                        • GetLastError.KERNEL32(?,00DC452F,?), ref: 00DD4FC5
                                                        • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,00DC452F), ref: 00DD5040
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00DC452F,?), ref: 00DD504B
                                                        • CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,00DC452F,?), ref: 00DD508B
                                                        • LocalFree.KERNEL32(00000000,?,00DC452F,?), ref: 00DD50B9
                                                        Strings
                                                        • Failed to create pipe: %ls, xrefs: 00DD4FF6, 00DD507C
                                                        • D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00DD4F08
                                                        • Failed to allocate full name of cache pipe: %ls, xrefs: 00DD5022
                                                        • \\.\pipe\%ls.Cache, xrefs: 00DD500C
                                                        • \\.\pipe\%ls, xrefs: 00DD4F6E
                                                        • pipe.cpp, xrefs: 00DD4F3A, 00DD4FE9, 00DD506F
                                                        • Failed to allocate full name of pipe: %ls, xrefs: 00DD4F84
                                                        • Failed to create the security descriptor for the connection event and pipe., xrefs: 00DD4F44
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
                                                        • String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
                                                        • API String ID: 1214480349-3253666091
                                                        • Opcode ID: 844f85e8f47e2092319378e6c91c77c0e84cb1658c57e98697b2d12e894dff82
                                                        • Instruction ID: d10c18ed793f38522c6a44c8af328e10cb0fb52532e41ca76f4bf88d6ff05fb0
                                                        • Opcode Fuzzy Hash: 844f85e8f47e2092319378e6c91c77c0e84cb1658c57e98697b2d12e894dff82
                                                        • Instruction Fuzzy Hash: AD519472D41726FBDB219BA59C46FEEBA64AF04720F140166FD10B63D0D3B65E808AF1
                                                        Function 00DFFA62 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 173encryptionfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00DD9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 00DFFAC7
                                                        • GetLastError.KERNEL32 ref: 00DFFAD1
                                                        • CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 00DFFB0E
                                                        • GetLastError.KERNEL32 ref: 00DFFB18
                                                        • CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00DFFB5F
                                                        • ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 00DFFB83
                                                        • GetLastError.KERNEL32 ref: 00DFFB8D
                                                        • CryptDestroyHash.ADVAPI32(00000000), ref: 00DFFBCA
                                                        • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00DFFBE1
                                                        • GetLastError.KERNEL32 ref: 00DFFBFC
                                                        • CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00DFFC34
                                                        • GetLastError.KERNEL32 ref: 00DFFC3E
                                                        • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 00DFFC77
                                                        • GetLastError.KERNEL32 ref: 00DFFC85
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
                                                        • String ID: cryputil.cpp
                                                        • API String ID: 3955742341-2185294990
                                                        • Opcode ID: 73e2e00e1f30d59ee78ad301eeef094db75e5c0b918e8604939d9811834c16dd
                                                        • Instruction ID: 5c87cc14fe824bd3cdcab11b4154b74a089d970c49fc285c01b21af677213a0f
                                                        • Opcode Fuzzy Hash: 73e2e00e1f30d59ee78ad301eeef094db75e5c0b918e8604939d9811834c16dd
                                                        • Instruction Fuzzy Hash: EB51A137D4023DABD7318B528C15BAB7A64BF04751F0680B5BF48FA290E7B19D849AF0
                                                        Function 00DD9E9E Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • moving, xrefs: 00DDA029
                                                        • Failed to concat complete cached path., xrefs: 00DD9EF4
                                                        • Failed to reset permissions on unverified cached payload: %ls, xrefs: 00DD9FF1
                                                        • Failed to get cached path for package with cache id: %ls, xrefs: 00DD9EC8
                                                        • Failed to move verified file to complete payload path: %ls, xrefs: 00DDA06C
                                                        • Failed to transfer working path to unverified path for payload: %ls., xrefs: 00DD9FA4
                                                        • Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00DD9FCB
                                                        • copying, xrefs: 00DDA030, 00DDA038
                                                        • Failed to create unverified path., xrefs: 00DD9F6E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
                                                        • API String ID: 0-1289240508
                                                        • Opcode ID: fc101bee703482ec21a3157053de8c2b7ef4d30b436d933a1d51644a10dda203
                                                        • Instruction ID: e4e02a33d6f219853c32bd0f69b20de8688a562444eaf368c4096d5dfa2396f7
                                                        • Opcode Fuzzy Hash: fc101bee703482ec21a3157053de8c2b7ef4d30b436d933a1d51644a10dda203
                                                        • Instruction Fuzzy Hash: 87517331944119FADF236BA4CD12FEDBB75AF04700F144052F900B52A1E7729EA0ABA5
                                                        Function 00DC62AA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetVersionExW.KERNEL32(0000011C), ref: 00DC62F8
                                                        • GetLastError.KERNEL32 ref: 00DC6302
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastVersion
                                                        • String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 305913169-1971907631
                                                        • Opcode ID: 2c84eeb4ca67b851675f751df31fa1eae917b23291cac7f2b3d7e3c853212555
                                                        • Instruction ID: 4771e8652941d32a934c673416219defeec9ca732ad3b88e978216a52305cfde
                                                        • Opcode Fuzzy Hash: 2c84eeb4ca67b851675f751df31fa1eae917b23291cac7f2b3d7e3c853212555
                                                        • Instruction Fuzzy Hash: BD41D572A04269ABDB209B59CC45FEF7BB8EB85710F04019EF545E7181D630DE81CBB0
                                                        Function 00DFFEC6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00E2B5FC,00000000,?,?,?,?,00DE12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00DFFEF4
                                                        • GetCurrentProcessId.KERNEL32(00000000,?,00DE12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00DFFF04
                                                        • GetCurrentThreadId.KERNEL32 ref: 00DFFF0D
                                                        • GetLocalTime.KERNEL32(8007139F,?,00DE12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00DFFF23
                                                        • LeaveCriticalSection.KERNEL32(00E2B5FC,00DE12CF,?,00000000,0000FDE9,?,00DE12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00E0001A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                        • String ID: $e$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(e$,e$0e
                                                        • API String ID: 296830338-1895243233
                                                        • Opcode ID: ae3db119026ecd65a596ecf111cffa57a62973d90b6703cb637ca6c6c725bf35
                                                        • Instruction ID: 72cae4c24d92cd1e385f5bb213509d02563f582c210398c3fb7a96b39dccae34
                                                        • Opcode Fuzzy Hash: ae3db119026ecd65a596ecf111cffa57a62973d90b6703cb637ca6c6c725bf35
                                                        • Instruction Fuzzy Hash: 20419D32D01219AFDB219FA5DC05BBEB7B9EF08B11F044525FA00B6290D7358D85CBB0
                                                        Function 00DC6037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemTime.KERNEL32(?), ref: 00DC6062
                                                        • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00DC6076
                                                        • GetLastError.KERNEL32 ref: 00DC6088
                                                        • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00DC60DC
                                                        • GetLastError.KERNEL32 ref: 00DC60E6
                                                        Strings
                                                        • Failed to get the Date., xrefs: 00DC610B
                                                        • Failed to get the required buffer length for the Date., xrefs: 00DC60AD
                                                        • Failed to allocate the buffer for the Date., xrefs: 00DC60C4
                                                        • Failed to set variant value., xrefs: 00DC6124
                                                        • variable.cpp, xrefs: 00DC60A3, 00DC6101
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: DateErrorFormatLast$SystemTime
                                                        • String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 2700948981-3682088697
                                                        • Opcode ID: 05ae827ea8f68f9c31c9b0d52c3396afd0c77d93e45340f0ff6ec6f096cb03d5
                                                        • Instruction ID: 238d957c4c830da4428b0b4c44d821db84978f014128591a3046f55ae09d16c5
                                                        • Opcode Fuzzy Hash: 05ae827ea8f68f9c31c9b0d52c3396afd0c77d93e45340f0ff6ec6f096cb03d5
                                                        • Instruction Fuzzy Hash: 1F318432A4072B6BDB219BE9CC42FAFBAA8EB04710F150129FA00F7181D661DD8596F1
                                                        Function 00DD9B43 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00DD9BF2
                                                        • lstrlenW.KERNEL32(?), ref: 00DD9C19
                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00DD9C79
                                                        • FindClose.KERNEL32(00000000), ref: 00DD9C84
                                                          • Part of subcall function 00DC3CC4: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00DC3D40
                                                          • Part of subcall function 00DC3CC4: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00DC3D53
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
                                                        • String ID: *.*$.unverified
                                                        • API String ID: 457978746-2528915496
                                                        • Opcode ID: 9b657493ddba88e5aa83a8efbbecd84dd062532bd2092db194478bf8c4a8a8e4
                                                        • Instruction ID: 6856cd81d1e1bbb09ee3caa048b7e1096276e90d75eceec5612f058739b56e59
                                                        • Opcode Fuzzy Hash: 9b657493ddba88e5aa83a8efbbecd84dd062532bd2092db194478bf8c4a8a8e4
                                                        • Instruction Fuzzy Hash: 7641627191152CAECB21AB64DD59BEAB7F8EF44301F4001E6E908F11A0EB729EC4DF64
                                                        Function 00E0887B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00E088D0
                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00E088E2
                                                        Strings
                                                        • %04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00E088B9
                                                        • %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00E0892D
                                                        • crypt32.dll, xrefs: 00E088A0
                                                        • feclient.dll, xrefs: 00E088AA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Time$InformationLocalSpecificSystemZone
                                                        • String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
                                                        • API String ID: 1772835396-1985132828
                                                        • Opcode ID: 4db47b103e7a7b06299b52efdf1a9e561e58b0ebf83488975d3665ffd495770b
                                                        • Instruction ID: 4a2aa9bc21cf611c2ce71168779c5983b317c33de6ca59a46c7c84868a645ad2
                                                        • Opcode Fuzzy Hash: 4db47b103e7a7b06299b52efdf1a9e561e58b0ebf83488975d3665ffd495770b
                                                        • Instruction Fuzzy Hash: 542128A6900128EADB20DB9ADC05EBFB3FCEB4C711F00855AF945E2190E7389A80D770
                                                        Function 00DFAA0E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: __floor_pentium4
                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                        • API String ID: 4168288129-2761157908
                                                        • Opcode ID: df4b889c98ab3dc65a8b1544470620e9580a00eeab371d7dd23059a2e49093e1
                                                        • Instruction ID: 03b568d9379b47aa24c32ecea0917c607b387e995782529f14b0a9b2e8ebc23b
                                                        • Opcode Fuzzy Hash: df4b889c98ab3dc65a8b1544470620e9580a00eeab371d7dd23059a2e49093e1
                                                        • Instruction Fuzzy Hash: 54C23A71E0462C8FDB25CE28DD407EAB7B5EB44314F1A81EAD54DE7240E778AE818F61
                                                        Function 00DC61DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastNameUser
                                                        • String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 2054405381-1522884404
                                                        • Opcode ID: 7162c1057920aaa5c00c003e5dcc61aa1f38d5484978ed1fc2d5e6e1728e2cbe
                                                        • Instruction ID: 8c91c93e78771819507f7dbb80fc76ea1a5962a640874971581339d3c73125f7
                                                        • Opcode Fuzzy Hash: 7162c1057920aaa5c00c003e5dcc61aa1f38d5484978ed1fc2d5e6e1728e2cbe
                                                        • Instruction Fuzzy Hash: BE01DB32A013295BC7219B559C05FAFB7A8DB00720F100259FD04F7281DA61DD858AF5
                                                        Function 00DFFE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,00E004F4,?,?,?,?,00000001), ref: 00DFFE40
                                                        • GetLastError.KERNEL32(?,00E004F4,?,?,?,?,00000001,?,00DC5616,?,?,00000000,?,?,00DC5395,00000002), ref: 00DFFE4C
                                                        • LocalFree.KERNEL32(00000000,?,?,00000000,?,?,00E004F4,?,?,?,?,00000001,?,00DC5616,?,?), ref: 00DFFEB5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFormatFreeLastLocalMessage
                                                        • String ID: logutil.cpp
                                                        • API String ID: 1365068426-3545173039
                                                        • Opcode ID: 66a819a42371cbfaf3cbc0dbf4c9e5f9cce30e7f7e54242e8f8813d845366d34
                                                        • Instruction ID: b5c217dbefb1b1572b293543eab6b91fd9c6dc0b83c975df71b601c6a08d64a3
                                                        • Opcode Fuzzy Hash: 66a819a42371cbfaf3cbc0dbf4c9e5f9cce30e7f7e54242e8f8813d845366d34
                                                        • Instruction Fuzzy Hash: 21115832A00229EADB319F959D05EBF7A69EF54B10F028069FE04AA161D7318A60D6B0
                                                        Function 00DE6B88 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00DE6B32,00000000,00000003), ref: 00DE6B9F
                                                        • GetLastError.KERNEL32(?,00DE6B32,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00DE6F28,?), ref: 00DE6BA9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ChangeConfigErrorLastService
                                                        • String ID: Failed to set service start type.$msuuser.cpp
                                                        • API String ID: 1456623077-1628545019
                                                        • Opcode ID: d65274a753fe52654b234da10aed20ae1aac6aaf61db2c9ca09fa0adcf4a1a15
                                                        • Instruction ID: c0e9e0dfc58cb3f2741002fea6d6d858943ffb1eaf3a5b350510b015ee1fdf74
                                                        • Opcode Fuzzy Hash: d65274a753fe52654b234da10aed20ae1aac6aaf61db2c9ca09fa0adcf4a1a15
                                                        • Instruction Fuzzy Hash: 67F0A033A492367BC62126969C09E8B7E48AF01BB0B110325FE28FA2D0DA52CD4082F0
                                                        Function 00DF3C76 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00DF3D6E
                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DF3D78
                                                        • UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00DF3D85
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                        • String ID:
                                                        • API String ID: 3906539128-0
                                                        • Opcode ID: cc550d9eceba25fe2c30dce05401e902efb909ed1fe902d8cc80b9d33eb61818
                                                        • Instruction ID: 3b8a1fe7b24abae4b031403ea4a64c334f9a5e4e79215a10de61299f7dd689cb
                                                        • Opcode Fuzzy Hash: cc550d9eceba25fe2c30dce05401e902efb909ed1fe902d8cc80b9d33eb61818
                                                        • Instruction Fuzzy Hash: 6131BF7491122CABCB21EF65DD89798BBB8FF08310F5045EAE80CA7251E7749F858F54
                                                        Function 00DF7B87 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: /
                                                        • API String ID: 0-2043925204
                                                        • Opcode ID: e91a010c80349ea0fb0ac8281f0a3d8b94ad9929d97cfe5da29f35e0f1fe4865
                                                        • Instruction ID: c4fa2f13b16c7aa6791029f744cc96a308fb704de199699408207f586470ae22
                                                        • Opcode Fuzzy Hash: e91a010c80349ea0fb0ac8281f0a3d8b94ad9929d97cfe5da29f35e0f1fe4865
                                                        • Instruction Fuzzy Hash: C341157250421C6ECB249FB9DC89EFB77B8EB84314F558668FA05D7180E6719E818B70
                                                        Function 00DFA560 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                        • Instruction ID: 3b183e1225687be53c7608cd464891770ebc5a5651ea473cc8c0d9a6e48c0e90
                                                        • Opcode Fuzzy Hash: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                        • Instruction Fuzzy Hash: E6021CB1E002199FDF14CFADC8806ADB7F5EF48314F1A816AD919EB344D770AE418BA1
                                                        Function 00E03A5F Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E03BF1: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00E03A8E,?), ref: 00E03C62
                                                        • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00E03AB2
                                                        • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00E03AC3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AllocateCheckCloseInitializeMembershipToken
                                                        • String ID:
                                                        • API String ID: 2114926846-0
                                                        • Opcode ID: 69fd868cdcad27f14448a0ca4732a38fd32794ec83b04d965861c87bc9fc6a4b
                                                        • Instruction ID: 9c232ec82c3bc766b4e652a95137ee2133cc5a214bae952763a89ee8666e64e4
                                                        • Opcode Fuzzy Hash: 69fd868cdcad27f14448a0ca4732a38fd32794ec83b04d965861c87bc9fc6a4b
                                                        • Instruction Fuzzy Hash: 1C113971A0020AEFDB10DFA5DC85BAFB7FDFF08304F50582AA541B6181E7719A84CB61
                                                        Function 00E04440 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FindFirstFileW.KERNEL32(00DE923A,?,00000100,00000000,00000000), ref: 00E0447B
                                                        • FindClose.KERNEL32(00000000), ref: 00E04487
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirst
                                                        • String ID:
                                                        • API String ID: 2295610775-0
                                                        • Opcode ID: 01ff656e3f636841b33b1805fe82958c93f1ceae317e910070216e3273829827
                                                        • Instruction ID: 5841452631393f341a0f0501ad4ff8ad5c28c2f40f6d2cd7197f492295041529
                                                        • Opcode Fuzzy Hash: 01ff656e3f636841b33b1805fe82958c93f1ceae317e910070216e3273829827
                                                        • Instruction Fuzzy Hash: 5D01F9B1A0021C6BCB20EF66ED89EABB3ACEBC5319F400065F914E32C0D6345D8D8764
                                                        Function 00DF2C18 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0$comres.dll
                                                        • API String ID: 0-3030269839
                                                        • Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                        • Instruction ID: 4018efb93f039862ea1a72aec9a81a912f55dd9d46e43b9d67a44832f750194e
                                                        • Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                        • Instruction Fuzzy Hash: 74517D70200B4C67DB38496889967FF2B95DB16340F2FC919EB87DB692C609DE4183B5
                                                        Function 00DFEE7C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DFEE77,?,?,00000008,?,?,00DFEB17,00000000), ref: 00DFF0A9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ExceptionRaise
                                                        • String ID:
                                                        • API String ID: 3997070919-0
                                                        • Opcode ID: 0b72cd7211fe5a247b5f9bf66e68fb9789048028268094b5ee216fd47d8dbc86
                                                        • Instruction ID: d2116e3b96ba711c035b834944569e250ae7c788f3bb2bda4b2d80d97b623394
                                                        • Opcode Fuzzy Hash: 0b72cd7211fe5a247b5f9bf66e68fb9789048028268094b5ee216fd47d8dbc86
                                                        • Instruction Fuzzy Hash: 63B15C31610609DFD715CF28C486B657BE0FF45364F2AC668EA99CF2A2C735E981CB50
                                                        Function 00DEEC07 Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00DEEC20
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FeaturePresentProcessor
                                                        • String ID:
                                                        • API String ID: 2325560087-0
                                                        • Opcode ID: 86a8851310a95f597e2862437ee4aa7c370282187ab695a14b2e5ca0585a79c5
                                                        • Instruction ID: 6c98da14db68e72b9d4f31f4637104b41b6b334077e14848cb4165afd506ebae
                                                        • Opcode Fuzzy Hash: 86a8851310a95f597e2862437ee4aa7c370282187ab695a14b2e5ca0585a79c5
                                                        • Instruction Fuzzy Hash: DB517C719002458FDB28DF5AD8857AABBF5FB48310F29807AD405EB250D3B19D46CF61
                                                        Function 00DEE9DC Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0002E9E8,00DEE131), ref: 00DEE9E1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterUnhandled
                                                        • String ID:
                                                        • API String ID: 3192549508-0
                                                        • Opcode ID: b4733edd013e9d940f909df25e678fbaedd911270463e7ec500f365eae7effa1
                                                        • Instruction ID: 13a7c91259e4a118b1139753f45c34b0305f41cfee6464c69de8c0c1a2ef7459
                                                        • Opcode Fuzzy Hash: b4733edd013e9d940f909df25e678fbaedd911270463e7ec500f365eae7effa1
                                                        • Instruction Fuzzy Hash:
                                                        Function 00DEFB89 Relevance: .5, Instructions: 481COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cddb85cda0775e492dd27f61bb90ee9b5ef25b9f4972d38223c5c5ee74a09e70
                                                        • Instruction ID: 6ac49b955a610de1d34f35e12e26f95743d70e8e516ef4b2f13d93bbf98c299a
                                                        • Opcode Fuzzy Hash: cddb85cda0775e492dd27f61bb90ee9b5ef25b9f4972d38223c5c5ee74a09e70
                                                        • Instruction Fuzzy Hash: 8702B4321081E64ADB2D4B3A847007A7FE16E827B171F87ADD8F6CB1D6DE20E564D670
                                                        Function 00DF0B6F Relevance: .4, Instructions: 352COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                        • Instruction ID: f2d66d36533a7b0e35dcfaaf786d2f3a1344675754d210da6b08f3b31d484a2e
                                                        • Opcode Fuzzy Hash: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                        • Instruction Fuzzy Hash: 8CC15F322091A60AEF6D4239847407EBFE15E923B131F9B9DE5F2CB1D6EE209535D630
                                                        Function 00DF07AA Relevance: .3, Instructions: 347COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                        • Instruction ID: c998b01d97e35865bf6780f61b16009363c6ceb78ea870f458c7d21c741c382b
                                                        • Opcode Fuzzy Hash: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                        • Instruction Fuzzy Hash: 6AC18B322091A64AEF2D4239847407EBFE15E923B131F979D95F2CB1D7EE209664DA30
                                                        Function 00DF03D5 Relevance: .3, Instructions: 331COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                        • Instruction ID: a66c80c5acc881fed17b2cb75447473e879fca3dd24461684e6c029dcb32c59e
                                                        • Opcode Fuzzy Hash: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                        • Instruction Fuzzy Hash: 11C17C322051A64BEB2D8639847407EBFE15A923B131F979DD6B2CB1D6EE20D534DA30
                                                        Function 00DF001D Relevance: .3, Instructions: 323COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                        • Instruction ID: cd86483f2fd48e419a818bdf87f4d960494413ce20593aaf763a1ebebb257c4b
                                                        • Opcode Fuzzy Hash: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                        • Instruction Fuzzy Hash: E2B17C322091A64BEF2D4339883447EBFE15A923B131F979ED5B2CB1C6EE209565D630
                                                        Function 00DF2E47 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7bd54a96e12fb6ed97a9d99052f379caaec46d7f76951d12ae26e56a6f7c62ea
                                                        • Instruction ID: cfd2236595583544646806c6a0cf2402044da832cda239f1e03469f8c13bffda
                                                        • Opcode Fuzzy Hash: 7bd54a96e12fb6ed97a9d99052f379caaec46d7f76951d12ae26e56a6f7c62ea
                                                        • Instruction Fuzzy Hash: 52618AB121070D66DB389A298856BBE73A4EF41704F6FC41AFB82DF281D611DE81C735
                                                        Function 00DCFF99 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 484registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 00DD0592
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close
                                                        • String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.1.2318$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$userVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
                                                        • API String ID: 3535843008-2755343042
                                                        • Opcode ID: 551a98e6b06f967da164071708b2b396a6d39ac8b5db431e1e64d46dacc979e3
                                                        • Instruction ID: 24d9483c525c7de80a5aa7fd718fad74b6904ca1db88791fa74fa622757457d5
                                                        • Opcode Fuzzy Hash: 551a98e6b06f967da164071708b2b396a6d39ac8b5db431e1e64d46dacc979e3
                                                        • Instruction Fuzzy Hash: F0F1A431A41726BBDF225664DD02FAE7EA5AF84710F051152FD00B63A1D7B1EDE0EAE0
                                                        Function 00DCCDBD Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 366COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00DC545D,00000000,00E0CA9C,00DC5445,00000000), ref: 00DCCEF3
                                                        Strings
                                                        • Invalid value for @Packaging: %ls, xrefs: 00DCD200
                                                        • Failed to get @Container., xrefs: 00DCD18D
                                                        • Failed to get @SourcePath., xrefs: 00DCD1F1
                                                        • Failed to select payload nodes., xrefs: 00DCCDEB
                                                        • Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00DCD1B9
                                                        • Failed to hex decode the Payload/@Hash., xrefs: 00DCD1DC
                                                        • Failed to get @FilePath., xrefs: 00DCD21A
                                                        • FilePath, xrefs: 00DCCEAB
                                                        • Failed to get @Id., xrefs: 00DCD221
                                                        • Failed to get @DownloadUrl., xrefs: 00DCD1EA
                                                        • external, xrefs: 00DCCF21
                                                        • Failed to get @Packaging., xrefs: 00DCD213
                                                        • Failed to get next node., xrefs: 00DCD228
                                                        • Failed to get @CertificateRootThumbprint., xrefs: 00DCD1C7
                                                        • Catalog, xrefs: 00DCD0EC
                                                        • Failed to allocate memory for payload structs., xrefs: 00DCCE49
                                                        • payload.cpp, xrefs: 00DCCE3F
                                                        • Failed to get @Catalog., xrefs: 00DCD1D5
                                                        • Failed to get payload node count., xrefs: 00DCCE10
                                                        • Failed to get @LayoutOnly., xrefs: 00DCD197
                                                        • Failed to find catalog., xrefs: 00DCD1CE
                                                        • Container, xrefs: 00DCCF4B
                                                        • Hash, xrefs: 00DCD0B7
                                                        • Failed to get @FileSize., xrefs: 00DCD1AB
                                                        • SourcePath, xrefs: 00DCCFB0
                                                        • LayoutOnly, xrefs: 00DCCF8D
                                                        • Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00DCD1B2
                                                        • download, xrefs: 00DCCEE5
                                                        • CertificateRootThumbprint, xrefs: 00DCD07A
                                                        • DownloadUrl, xrefs: 00DCCFD9
                                                        • FileSize, xrefs: 00DCD002
                                                        • Failed to to find container: %ls, xrefs: 00DCD186
                                                        • Failed to parse @FileSize., xrefs: 00DCD1A1
                                                        • Payload, xrefs: 00DCCDD8
                                                        • embedded, xrefs: 00DCCF05
                                                        • Packaging, xrefs: 00DCCEC6
                                                        • Failed to hex decode @CertificateRootThumbprint., xrefs: 00DCD1C0
                                                        • CertificateRootPublicKeyIdentifier, xrefs: 00DCD03D
                                                        • Failed to get @Hash., xrefs: 00DCD1E3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateCompareProcessString
                                                        • String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$download$embedded$external$payload.cpp
                                                        • API String ID: 1171520630-3127305756
                                                        • Opcode ID: f4f89551c2441c8b043e57085f0b73fd1dc1bda8e314bc996afe4e949e1fcc94
                                                        • Instruction ID: 71b4458cf40366f38bb159f26efed2c49edd7bc61002a3dbe9d1f9974f3e8fd8
                                                        • Opcode Fuzzy Hash: f4f89551c2441c8b043e57085f0b73fd1dc1bda8e314bc996afe4e949e1fcc94
                                                        • Instruction Fuzzy Hash: 7EC1E372D4532BBBCB21DA94CC41F6DB6A6AF04B20F241279F901B75D0D770EE909AA0
                                                        Function 00DC8476 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00DC5445,?,00000000,80070490,?,?,?,?,?,?,?,?,00DEC1BF,?,00DC5445,?), ref: 00DC84A7
                                                        • LeaveCriticalSection.KERNEL32(00DC5445,?,?,?,?,?,?,?,?,00DEC1BF,?,00DC5445,?,00DC5445,00DC5445,Chain), ref: 00DC8804
                                                        Strings
                                                        • Variable, xrefs: 00DC84B1
                                                        • Failed to select variable nodes., xrefs: 00DC84C4
                                                        • Failed to get @Type., xrefs: 00DC8788
                                                        • Initializing hidden variable '%ls', xrefs: 00DC8671
                                                        • Failed to get @Persisted., xrefs: 00DC87E1
                                                        • version, xrefs: 00DC862C
                                                        • Failed to get @Id., xrefs: 00DC87EF
                                                        • Initializing string variable '%ls' to value '%ls', xrefs: 00DC861A
                                                        • Failed to find variable value '%ls'., xrefs: 00DC87D2
                                                        • Failed to get next node., xrefs: 00DC87F6
                                                        • numeric, xrefs: 00DC85BC
                                                        • Hidden, xrefs: 00DC852F
                                                        • Failed to get @Value., xrefs: 00DC8796
                                                        • Type, xrefs: 00DC85A3
                                                        • Initializing numeric variable '%ls' to value '%ls', xrefs: 00DC85E2
                                                        • Value, xrefs: 00DC8565
                                                        • Failed to set value of variable: %ls, xrefs: 00DC87A7
                                                        • Attempt to set built-in variable value: %ls, xrefs: 00DC87C8
                                                        • Failed to insert variable '%ls'., xrefs: 00DC86C6
                                                        • Failed to get variable node count., xrefs: 00DC84E1
                                                        • Invalid value for @Type: %ls, xrefs: 00DC8778
                                                        • Failed to set variant value., xrefs: 00DC878F
                                                        • Failed to set variant encryption, xrefs: 00DC879D
                                                        • variable.cpp, xrefs: 00DC87B9
                                                        • Failed to get @Hidden., xrefs: 00DC87E8
                                                        • Persisted, xrefs: 00DC854A
                                                        • Initializing version variable '%ls' to value '%ls', xrefs: 00DC8653
                                                        • Failed to change variant type., xrefs: 00DC87DA
                                                        • string, xrefs: 00DC85F7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
                                                        • API String ID: 3168844106-1614826165
                                                        • Opcode ID: f5e1b217f78b22b376495faf02365a6f9547486636082eb995170e09b7eef111
                                                        • Instruction ID: d538711bd3c0f82db377df4c07c039cc5aefadb68b0eaff307c7db21af9cb9c4
                                                        • Opcode Fuzzy Hash: f5e1b217f78b22b376495faf02365a6f9547486636082eb995170e09b7eef111
                                                        • Instruction Fuzzy Hash: BEB18072D4021ABBCF119B94CC45FAEBBB5AF44710F340259F915B72D1DB719A80EBA0
                                                        Function 00DE6CCC Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 379COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00DDBDDC,00000007,?,?,?), ref: 00DE6D20
                                                          • Part of subcall function 00E00ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00DC5EB2,00000000), ref: 00E00AE0
                                                          • Part of subcall function 00E00ACC: GetProcAddress.KERNEL32(00000000), ref: 00E00AE7
                                                          • Part of subcall function 00E00ACC: GetLastError.KERNEL32(?,?,?,00DC5EB2,00000000), ref: 00E00AFE
                                                        • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00DE710F
                                                        • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00DE7123
                                                        Strings
                                                        • Failed to ensure WU service was enabled to install MSU package., xrefs: 00DE6F2E
                                                        • Failed to append SysNative directory., xrefs: 00DE6D7D
                                                        • SysNative\, xrefs: 00DE6D6A
                                                        • "%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00DE6E75
                                                        • Failed to find Windows directory., xrefs: 00DE6D5F
                                                        • Failed to get action arguments for MSU package., xrefs: 00DE6DD6
                                                        • wusa.exe, xrefs: 00DE6DA0
                                                        • Failed to get process exit code., xrefs: 00DE702C
                                                        • Failed to determine WOW64 status., xrefs: 00DE6D32
                                                        • Failed to wait for executable to complete: %ls, xrefs: 00DE709E
                                                        • 2, xrefs: 00DE6FB3
                                                        • Failed to find System32 directory., xrefs: 00DE6D95
                                                        • Failed to build MSU path., xrefs: 00DE6E35
                                                        • D, xrefs: 00DE6F3B
                                                        • Failed to append log path to MSU command-line., xrefs: 00DE6ED4
                                                        • WixBundleExecutePackageCacheFolder, xrefs: 00DE6E0B, 00DE713B
                                                        • msuuser.cpp, xrefs: 00DE6F8D, 00DE7022, 00DE704A
                                                        • Failed to allocate WUSA.exe path., xrefs: 00DE6DB3
                                                        • Failed to get cached path for package: %ls, xrefs: 00DE6DFC
                                                        • Bootstrapper application aborted during MSU progress., xrefs: 00DE7054
                                                        • Failed to CreateProcess on path: %ls, xrefs: 00DE6F9A
                                                        • Failed to format MSU install command., xrefs: 00DE6E5C
                                                        • Failed to append log switch to MSU command-line., xrefs: 00DE6EB6
                                                        • /log:, xrefs: 00DE6EA2
                                                        • Failed to format MSU uninstall command., xrefs: 00DE6E89
                                                        • "%ls" "%ls" /quiet /norestart, xrefs: 00DE6E48
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
                                                        • String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuuser.cpp$wusa.exe
                                                        • API String ID: 1400713077-4261965642
                                                        • Opcode ID: 0ac9d6cd3f143dd958e2166478fec577c6b9cdde3c0005d2e01ba59c21556c4b
                                                        • Instruction ID: e9c2248a6cac532f72c8580e8c668e68db336e0ec126fc2f0e64a578a714b272
                                                        • Opcode Fuzzy Hash: 0ac9d6cd3f143dd958e2166478fec577c6b9cdde3c0005d2e01ba59c21556c4b
                                                        • Instruction Fuzzy Hash: 29D1B071A4435ABBDF12AFA6CC85FEEBAB8EF18740F104025F604B2191D7B5D9849B70
                                                        Function 00E0744A Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 340COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00E0755D
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07726
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E077C3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$FreeHeap$AllocateCompareProcess
                                                        • String ID: ($@$`Dv$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
                                                        • API String ID: 1555028553-177796383
                                                        • Opcode ID: 38591c73ea7999b74b892ffeb77a4a0b5c5965deaf99029b214a287bfee83013
                                                        • Instruction ID: 8bd69c966b5c6796059e24cdb8cdae0f02749347af13f51ce9174feff039735d
                                                        • Opcode Fuzzy Hash: 38591c73ea7999b74b892ffeb77a4a0b5c5965deaf99029b214a287bfee83013
                                                        • Instruction Fuzzy Hash: B0B19E31D48226BBCB119BA4CC41FAEBA74AB04765F242355F661BB1D1D770FE90CBA0
                                                        Function 00E0710D Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 298COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00E23E78,000000FF,?,?,?), ref: 00E071D4
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 00E071F9
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00E07219
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00E07235
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00E0725D
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00E07279
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 00E072B2
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00E072EB
                                                          • Part of subcall function 00E06D50: SysFreeString.OLEAUT32(00000000), ref: 00E06E89
                                                          • Part of subcall function 00E06D50: SysFreeString.OLEAUT32(00000000), ref: 00E06EC8
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E0736F
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E0741F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$Compare$Free
                                                        • String ID: ($`Dv$atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
                                                        • API String ID: 318886736-3891805788
                                                        • Opcode ID: d8d83c5ef89fe587c26bd9cefe6df4ad46a88479462b673c597829630abca1a2
                                                        • Instruction ID: 08b3792c4f751da2afe2d2a807473bb34ab4b3c5da59474f81b03e0b8a510a74
                                                        • Opcode Fuzzy Hash: d8d83c5ef89fe587c26bd9cefe6df4ad46a88479462b673c597829630abca1a2
                                                        • Instruction Fuzzy Hash: D1A19F31D08226FBDB219BA4CC41FAEBB64AB04734F206355F961B61D1DB74FA90DB90
                                                        Function 00DED43E Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 290synchronizationprocessCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • UuidCreate.RPCRT4(?), ref: 00DED4B3
                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 00DED4DC
                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 00DED5C5
                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 00DED5CF
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 00DED668
                                                        • WaitForSingleObject.KERNEL32(00E0B500,000000FF,?,?,?,?), ref: 00DED673
                                                        • ReleaseMutex.KERNEL32(00E0B500,?,?,?,?), ref: 00DED69D
                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00DED6BE
                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 00DED6CC
                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 00DED704
                                                          • Part of subcall function 00DED33E: WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,?,00DED642,?), ref: 00DED357
                                                          • Part of subcall function 00DED33E: ReleaseMutex.KERNEL32(?,?,?,?,00DED642,?), ref: 00DED375
                                                          • Part of subcall function 00DED33E: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DED3B6
                                                          • Part of subcall function 00DED33E: ReleaseMutex.KERNEL32(?), ref: 00DED3CD
                                                          • Part of subcall function 00DED33E: SetEvent.KERNEL32(?), ref: 00DED3D6
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DED7B9
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DED7D1
                                                        Strings
                                                        • %ls /pipe %ls, xrefs: 00DED57F
                                                        • NetFxSection.%ls, xrefs: 00DED509
                                                        • Failed to convert netfx chainer guid into string., xrefs: 00DED4FB
                                                        • Failed to get netfx return code., xrefs: 00DED6FA
                                                        • Failed to process netfx chainer message., xrefs: 00DED648
                                                        • Failed to allocate netfx chainer arguments., xrefs: 00DED593
                                                        • NetFxEvent.%ls, xrefs: 00DED52B
                                                        • Failed to CreateProcess on path: %ls, xrefs: 00DED5FE
                                                        • NetFxChainer.cpp, xrefs: 00DED4F1, 00DED5F3, 00DED6F0, 00DED728
                                                        • Failed to create netfx chainer guid., xrefs: 00DED4C0
                                                        • Failed to create netfx chainer., xrefs: 00DED55E
                                                        • Failed to wait for netfx chainer process to complete, xrefs: 00DED732
                                                        • Failed to allocate event name., xrefs: 00DED53F
                                                        • D, xrefs: 00DED5AA
                                                        • Failed to allocate section name., xrefs: 00DED51D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
                                                        • String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
                                                        • API String ID: 1533322865-1825855094
                                                        • Opcode ID: 9be8c8d06aedecb1d5e9448030046a7ed7032f7794cf3ec7a257408ec25ba8e4
                                                        • Instruction ID: 016c7d479bb941b8533e687629b728e3eb03d24be0232f6d888915ea6a010a30
                                                        • Opcode Fuzzy Hash: 9be8c8d06aedecb1d5e9448030046a7ed7032f7794cf3ec7a257408ec25ba8e4
                                                        • Instruction Fuzzy Hash: B3A1AE72D00369AFDB21ABA5CC45BAEB7B9BF04310F104169E909F7292DB359D448FB1
                                                        Function 00DD54DC Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 229filepipesleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,00000000,?,00E0B500,?,00000000,?,00DC452F,?,00E0B500), ref: 00DD54FD
                                                        • GetCurrentProcessId.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD5508
                                                        • SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD553F
                                                        • ConnectNamedPipe.KERNEL32(?,00000000,?,00DC452F,?,00E0B500), ref: 00DD5554
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD555E
                                                        • Sleep.KERNEL32(00000064,?,00DC452F,?,00E0B500), ref: 00DD5593
                                                        • SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55B6
                                                        • WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55D1
                                                        • WriteFile.KERNEL32(?,00DC452F,00E0B500,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55EC
                                                        • WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD5607
                                                        • ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD5622
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD567D
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD56B1
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD56E5
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD5719
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD574A
                                                        • GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD577B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
                                                        • String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
                                                        • API String ID: 2944378912-2047837012
                                                        • Opcode ID: e2a978043d91d2bfab4068c43879c0b00a9254755e6c62a0776870b9ffc21081
                                                        • Instruction ID: 0d3589ebb57b53a90b7290e2252ba181aa1554da05d424ab5baf1b1ac2feec36
                                                        • Opcode Fuzzy Hash: e2a978043d91d2bfab4068c43879c0b00a9254755e6c62a0776870b9ffc21081
                                                        • Instruction Fuzzy Hash: A071D7B6D81736BBDB209BA5AC45FAE66A8AF04B10F254126BD00FB3C0D775DD4086F0
                                                        Function 00DCA416 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCA45A
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCA480
                                                        • RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 00DCA768
                                                        Strings
                                                        • Failed to allocate memory registry value., xrefs: 00DCA587
                                                        • Failed to open registry key., xrefs: 00DCA4ED
                                                        • Failed to change value type., xrefs: 00DCA70F
                                                        • RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00DCA740
                                                        • Failed to allocate string buffer., xrefs: 00DCA667
                                                        • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00DCA51C
                                                        • Failed to set variable., xrefs: 00DCA72B
                                                        • Registry key not found. Key = '%ls', xrefs: 00DCA4B4
                                                        • search.cpp, xrefs: 00DCA54A, 00DCA57D, 00DCA5D0, 00DCA6D3
                                                        • Failed to read registry value., xrefs: 00DCA6F6
                                                        • Failed to query registry key value., xrefs: 00DCA5DA
                                                        • Failed to format key string., xrefs: 00DCA465
                                                        • Failed to get expand environment string., xrefs: 00DCA6DD
                                                        • Failed to query registry key value size., xrefs: 00DCA554
                                                        • Failed to clear variable., xrefs: 00DCA4D8
                                                        • Failed to format value string., xrefs: 00DCA48B
                                                        • Unsupported registry key value type. Type = '%u', xrefs: 00DCA608
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16$Close
                                                        • String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
                                                        • API String ID: 2348241696-3124384294
                                                        • Opcode ID: ea7531ebd449b17398ed349fcef59d9d9299f268a4db42cd00390e9e639566c9
                                                        • Instruction ID: 08dbe40e26935d35d81a84cfac9bb9385618073cd7360af00f88f76c28edcc89
                                                        • Opcode Fuzzy Hash: ea7531ebd449b17398ed349fcef59d9d9299f268a4db42cd00390e9e639566c9
                                                        • Instruction Fuzzy Hash: 88A1C672D4062FBBCB129AE8CC45FAEBA78FB04714F158529F904B7290D671D9409AB2
                                                        Function 00DC5770 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 479stringCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000000,00000000,?,00DCA8B4,00000100,000002C0,000002C0,00000100), ref: 00DC5795
                                                        • lstrlenW.KERNEL32(000002C0,?,00DCA8B4,00000100,000002C0,000002C0,00000100), ref: 00DC579F
                                                        • _wcschr.LIBVCRUNTIME ref: 00DC59A7
                                                        • LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,00DCA8B4,00000100,000002C0,000002C0,00000100), ref: 00DC5C4A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave_wcschrlstrlen
                                                        • String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
                                                        • API String ID: 1026845265-2050445661
                                                        • Opcode ID: bff6cd5f385391fbc4f77b82bf2bfd36d5f5a38a97d2f7a9f59f39f9fb419657
                                                        • Instruction ID: 22d7a8f3a9323af53c31ad153179ffd7421ca97a941deef606e26322e45d65a9
                                                        • Opcode Fuzzy Hash: bff6cd5f385391fbc4f77b82bf2bfd36d5f5a38a97d2f7a9f59f39f9fb419657
                                                        • Instruction Fuzzy Hash: 31F1737190171BEADB119FA59D41FAF7BA4EF04B20F15812DF905BB284D734AE818BB0
                                                        Function 00DECE81 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 240synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,00DED558,?,?,?), ref: 00DECEC7
                                                        • GetLastError.KERNEL32(?,?,00DED558,?,?,?), ref: 00DECED4
                                                        • ReleaseMutex.KERNEL32(?), ref: 00DED13C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
                                                        • String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
                                                        • API String ID: 3944734951-2991465304
                                                        • Opcode ID: 0970cc687376257f012baa0971709af772c78a1e4c174a01e8370b08330c2204
                                                        • Instruction ID: f91809e95a40cfd5fca23fa2a2fad5198fdf1aac362d0319bfce296cb139e1a4
                                                        • Opcode Fuzzy Hash: 0970cc687376257f012baa0971709af772c78a1e4c174a01e8370b08330c2204
                                                        • Instruction Fuzzy Hash: B8810176A81772BBC721AB668C09F5ABAA5FF04720F154114FD18BB292DB31DD408AF0
                                                        Function 00DCEA42 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E032F3: VariantInit.OLEAUT32(?), ref: 00E03309
                                                          • Part of subcall function 00E032F3: SysAllocString.OLEAUT32(?), ref: 00E03325
                                                          • Part of subcall function 00E032F3: VariantClear.OLEAUT32(?), ref: 00E033AC
                                                          • Part of subcall function 00E032F3: SysFreeString.OLEAUT32(00000000), ref: 00E033B7
                                                        • CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,00E0CA9C,?,?,Action,?,?,?,00000000,00DC5445), ref: 00DCEB13
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 00DCEB5D
                                                        Strings
                                                        • Failed to get next RelatedBundle element., xrefs: 00DCEC70
                                                        • Invalid value for @Action: %ls, xrefs: 00DCEC52
                                                        • Action, xrefs: 00DCEAD0
                                                        • Failed to resize Patch code array in registration, xrefs: 00DCEC43
                                                        • Failed to resize Upgrade code array in registration, xrefs: 00DCEC35
                                                        • Failed to get @Id., xrefs: 00DCEC62
                                                        • version.dll, xrefs: 00DCEB70
                                                        • Failed to resize Detect code array in registration, xrefs: 00DCEC2E
                                                        • Failed to get RelatedBundle nodes, xrefs: 00DCEA72
                                                        • Detect, xrefs: 00DCEB04
                                                        • Failed to get @Action., xrefs: 00DCEC69
                                                        • Failed to resize Addon code array in registration, xrefs: 00DCEC3C
                                                        • Failed to get RelatedBundle element count., xrefs: 00DCEA97
                                                        • Addon, xrefs: 00DCEB9A
                                                        • comres.dll, xrefs: 00DCEB26
                                                        • Patch, xrefs: 00DCEBDD
                                                        • RelatedBundle, xrefs: 00DCEA50
                                                        • cabinet.dll, xrefs: 00DCEBBA
                                                        • Upgrade, xrefs: 00DCEB50
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$CompareVariant$AllocClearFreeInit
                                                        • String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
                                                        • API String ID: 702752599-259800149
                                                        • Opcode ID: 1e3f449f628b9eba8ddcdd735dbdb7deb883eb2b1550e8d15001530a93156cc4
                                                        • Instruction ID: 4eb92de055dbc28e407c4e3ba84926b0bc4d0ebfaebbc265df8d4574a04d5a42
                                                        • Opcode Fuzzy Hash: 1e3f449f628b9eba8ddcdd735dbdb7deb883eb2b1550e8d15001530a93156cc4
                                                        • Instruction Fuzzy Hash: 14716CB1A05627BFCB10DAA4CA45FAAB7B4FB04720F205258E911B76D1D770AE51CBA0
                                                        Function 00DD46DC Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 185fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00DD4BF5,00E0B4E8,?,feclient.dll,00000000,?,?), ref: 00DD46F3
                                                        • ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00DD4BF5,00E0B4E8,?,feclient.dll,00000000,?,?), ref: 00DD4714
                                                        • GetLastError.KERNEL32(?,00DD4BF5,00E0B4E8,?,feclient.dll,00000000,?,?), ref: 00DD471A
                                                        • ReadFile.KERNEL32(feclient.dll,00000000,00E0B518,?,00000000,00000000,00E0B519,?,00DD4BF5,00E0B4E8,?,feclient.dll,00000000,?,?), ref: 00DD47A8
                                                        • GetLastError.KERNEL32(?,00DD4BF5,00E0B4E8,?,feclient.dll,00000000,?,?), ref: 00DD47AE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastRead$CurrentProcess
                                                        • String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
                                                        • API String ID: 1233551569-452622383
                                                        • Opcode ID: a410dea9d474dc36866c4265cf0623c046c94e3a1b8f9818d578edbe2d25b9fd
                                                        • Instruction ID: ca74bd5cf293d996d933122fa00d9d957d90353951111f5ed4ee0c96c5e5b62c
                                                        • Opcode Fuzzy Hash: a410dea9d474dc36866c4265cf0623c046c94e3a1b8f9818d578edbe2d25b9fd
                                                        • Instruction Fuzzy Hash: 1351D7B6E41326BBDB219A958C46FAF7668BF01B60F154126FE10BB3C0D7718D4096F0
                                                        Function 00DE27FC Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: StringVariant$AllocClearFreeInit
                                                        • String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
                                                        • API String ID: 760788290-1911311241
                                                        • Opcode ID: a0dc6d93703edfeef901530fe85784353eb209290fc7df8dcb590a1afc192a90
                                                        • Instruction ID: cf38202ef650a97740b69a035413bbd3576ed91fcde969b286d4b708ede995e4
                                                        • Opcode Fuzzy Hash: a0dc6d93703edfeef901530fe85784353eb209290fc7df8dcb590a1afc192a90
                                                        • Instruction Fuzzy Hash: 33411972EC87A2FACA2165658C42FBAB25C6B15730F242321F924B72C2C7609D8096F1
                                                        Function 00DC8F72 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetStringTypeW.KERNEL32(00000001,5600E0DB,00000001,?,00DC9946,?,00000000,00000000,?,?,00DC992E,?,?,00000000,?), ref: 00DC8FB2
                                                        Strings
                                                        • Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00DC9242
                                                        • Failed to set symbol value., xrefs: 00DC9060
                                                        • -, xrefs: 00DC9118
                                                        • AND, xrefs: 00DC92BC
                                                        • Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00DC9408
                                                        • Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00DC93C4
                                                        • NOT, xrefs: 00DC92DB
                                                        • Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00DC9380
                                                        • Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00DC9162
                                                        • condition.cpp, xrefs: 00DC9084, 00DC914E, 00DC91CA, 00DC922E, 00DC936C, 00DC93B0, 00DC93F4
                                                        • Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00DC9098
                                                        • Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00DC91DE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: StringType
                                                        • String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
                                                        • API String ID: 4177115715-3594736606
                                                        • Opcode ID: f25f88dfe107ba75d022e09a5c69876998de8e08b85fdad437ce11d4bcc0ddce
                                                        • Instruction ID: a3f3c00cf6bcd677cfd1d562a4a484cf5209557841dca32688351ee4c4e6ca98
                                                        • Opcode Fuzzy Hash: f25f88dfe107ba75d022e09a5c69876998de8e08b85fdad437ce11d4bcc0ddce
                                                        • Instruction Fuzzy Hash: 7DF1D071608303EBDB298F94C8ADFAAFBA4FB04700F14414DF9459B585C3B5DA92DBA4
                                                        Function 00DE1BB1 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00DE1CB8
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00DE1CD6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareHeapString$AllocateProcess
                                                        • String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeuser.cpp$forceReboot$scheduleReboot$success
                                                        • API String ID: 2664528157-1714101571
                                                        • Opcode ID: 5ccb8c8e43f5e977ee1a5e6af7934fa97b57abf54be9b6bb0000e2213d7219a4
                                                        • Instruction ID: 025f92f7270820e323e6933e40dcd9cc432cea96cd68ab810b53427127fac4ec
                                                        • Opcode Fuzzy Hash: 5ccb8c8e43f5e977ee1a5e6af7934fa97b57abf54be9b6bb0000e2213d7219a4
                                                        • Instruction Fuzzy Hash: 9161D739B44256BBCB10AB96CC41EAEBBA5EF44720F204655F421BB2D0DB70DE40CBA0
                                                        Function 00E077F7 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00E07857
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00E0787C
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00E0789C
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00E078CF
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00E078EB
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07916
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E0798D
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E079D9
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$Compare$Free
                                                        • String ID: `Dv$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
                                                        • API String ID: 318886736-1313079583
                                                        • Opcode ID: 9428e72397ede069f834b84f898332abaa53bf1890bef69b99a6dda969b0e785
                                                        • Instruction ID: 54e83501fe2ac53831eab20b3a902f16e4b3ec539723bf4afac18a5926512e07
                                                        • Opcode Fuzzy Hash: 9428e72397ede069f834b84f898332abaa53bf1890bef69b99a6dda969b0e785
                                                        • Instruction Fuzzy Hash: AB618F31D08229BFDF15DBA4CC45EAEB7B9AF04320F6152A5E5A1B71D0D730AE90DB90
                                                        Function 00DD6BCA Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 351synchronizationthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DCD4A8: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00DD7040,000000B8,00000000,?,00000000,7694B390), ref: 00DCD4B7
                                                          • Part of subcall function 00DCD4A8: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00DCD4C6
                                                          • Part of subcall function 00DCD4A8: LeaveCriticalSection.KERNEL32(000000D0,?,00DD7040,000000B8,00000000,?,00000000,7694B390), ref: 00DCD4DB
                                                        • CreateThread.KERNEL32(00000000,00000000,00DD57BD,?,00000000,00000000), ref: 00DD6E34
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00DC4522,?,00E0B500,?,00DC4846,?,?), ref: 00DD6E43
                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00DC4522,?,00E0B500,?,00DC4846,?,?), ref: 00DD6EA0
                                                        • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00DD6F92
                                                        • CloseHandle.KERNEL32(00000000), ref: 00DD6F9B
                                                        • CloseHandle.KERNEL32(crypt32.dll,?,00000000,?,00000000,00000001,00000000), ref: 00DD6FB5
                                                          • Part of subcall function 00DEBD05: SetThreadExecutionState.KERNEL32(80000001), ref: 00DEBD0A
                                                        Strings
                                                        • Failed to register bundle., xrefs: 00DD6DEE
                                                        • Failed to elevate., xrefs: 00DD6D94
                                                        • core.cpp, xrefs: 00DD6C8A, 00DD6E67
                                                        • Failed to cache user to working directory., xrefs: 00DD6D71
                                                        • Failed to create cache thread., xrefs: 00DD6E71
                                                        • UX aborted apply begin., xrefs: 00DD6C94
                                                        • Another per-machine setup is already executing., xrefs: 00DD6DC8
                                                        • Another per-user setup is already executing., xrefs: 00DD6CD8
                                                        • user cannot start apply because it is busy with another action., xrefs: 00DD6C28
                                                        • Failed to set initial apply variables., xrefs: 00DD6D02
                                                        • crypt32.dll, xrefs: 00DD6ECD, 00DD6EE7, 00DD6FB4
                                                        • Failed while caching, aborting execution., xrefs: 00DD6E98
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$CriticalSectionThread$CompareCreateEnterErrorExchangeExecutionInterlockedLastLeaveMutexReleaseState
                                                        • String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$user cannot start apply because it is busy with another action.$Failed to cache user to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
                                                        • API String ID: 2169948125-4292671789
                                                        • Opcode ID: 810ea6ab614611294f516cde0bad018047fb72101154be96ee9aa468d618f05c
                                                        • Instruction ID: 2e0fd86eab531f6f017ffef1393c15c806f2f80b9f13013da386a18eeddd6842
                                                        • Opcode Fuzzy Hash: 810ea6ab614611294f516cde0bad018047fb72101154be96ee9aa468d618f05c
                                                        • Instruction Fuzzy Hash: 98C1AD72900615EADF119FA4D885BEE3AA9EF04714F08417BFD09AE246DB70D984CBF1
                                                        Function 00E08134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00E08161
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00E0817C
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 00E0821F
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,00E0B518,00000000), ref: 00E0825E
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00E082B1
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00E0B518,000000FF,true,000000FF), ref: 00E082CF
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00E08307
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00E0844B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
                                                        • API String ID: 1825529933-3037633208
                                                        • Opcode ID: 1c10ff198dac50398835eb31c7d2f546d7db1af3845a866013c10256031b9b17
                                                        • Instruction ID: d856450930f6d00bd446ae9b6bf73c97b6795eb861100dfa4bba579589fb1cf0
                                                        • Opcode Fuzzy Hash: 1c10ff198dac50398835eb31c7d2f546d7db1af3845a866013c10256031b9b17
                                                        • Instruction Fuzzy Hash: 06B19931604316ABCB209F54CE81F5A7BA6BF44734F259618F9B5BB2E1DB70E881CB10
                                                        Function 00DDE3C8 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 146registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DDE2AF: LoadBitmapW.USER32(?,00000001), ref: 00DDE2E5
                                                          • Part of subcall function 00DDE2AF: GetLastError.KERNEL32 ref: 00DDE2F1
                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00DDE429
                                                        • RegisterClassW.USER32(?), ref: 00DDE43D
                                                        • GetLastError.KERNEL32 ref: 00DDE448
                                                        • UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00DDE54D
                                                        • DeleteObject.GDI32(00000000), ref: 00DDE55C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
                                                        • String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
                                                        • API String ID: 164797020-2188509422
                                                        • Opcode ID: 56300f8717d9204ca233369d14c2c65a3c9be9ffc68044c0f0e4a469a87c22f6
                                                        • Instruction ID: 7a0063998855396dfa1927789d1e4ca76a24e095d1e045bae16679ff7976ec69
                                                        • Opcode Fuzzy Hash: 56300f8717d9204ca233369d14c2c65a3c9be9ffc68044c0f0e4a469a87c22f6
                                                        • Instruction Fuzzy Hash: BF41B772900615BFDB11ABD4EC05EAEB7B8FF04750F100126F901FA251E7759D448BB1
                                                        Function 00DE9DE1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 233threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,00DEBC85,00000001), ref: 00DE9E46
                                                        • GetLastError.KERNEL32(?,00DEBC85,00000001), ref: 00DE9FB6
                                                        • GetExitCodeThread.KERNEL32(00000001,00000000,?,00DEBC85,00000001), ref: 00DE9FF6
                                                        • GetLastError.KERNEL32(?,00DEBC85,00000001), ref: 00DEA000
                                                        Strings
                                                        • Failed to load compatible package on per-machine package., xrefs: 00DE9F5C
                                                        • apply.cpp, xrefs: 00DE9FDD, 00DEA027
                                                        • Invalid execute action., xrefs: 00DEA056
                                                        • Failed to execute MSI package., xrefs: 00DE9EA6
                                                        • Failed to execute dependency action., xrefs: 00DE9F36
                                                        • Failed to execute package provider registration action., xrefs: 00DE9F17
                                                        • Failed to execute MSP package., xrefs: 00DE9ECB
                                                        • Failed to execute MSU package., xrefs: 00DE9EFB
                                                        • Cache thread exited unexpectedly., xrefs: 00DEA047
                                                        • Failed to wait for cache check-point., xrefs: 00DE9FE7
                                                        • Failed to get cache thread exit code., xrefs: 00DEA031
                                                        • Failed to execute EXE package., xrefs: 00DE9E7D
                                                        • Failed to execute compatible package action., xrefs: 00DE9F73
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
                                                        • String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
                                                        • API String ID: 3703294532-2662572847
                                                        • Opcode ID: 17dd604e387669f935671bbce0c10b8d66332a312273143673ea1175537cc8c1
                                                        • Instruction ID: 14742966c745f5460eb1630c99149ee7adfcfae7d37ce5931022443a50eaae0b
                                                        • Opcode Fuzzy Hash: 17dd604e387669f935671bbce0c10b8d66332a312273143673ea1175537cc8c1
                                                        • Instruction Fuzzy Hash: B2715F71A4225AEFDB10EF65C941AAEBBB8EF44B10F104169F905F7250D231EE409BB1
                                                        Function 00DCF210 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 183registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E03AF1: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 00E03B3E
                                                        • RegCloseKey.ADVAPI32(00000000,?,00E10D10,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 00DCF440
                                                          • Part of subcall function 00E014A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00DCF28D,00E10D10,Resume,00000005,?,00000000,00000000,00000000), ref: 00E014BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseValueVersion
                                                        • String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$registration.cpp
                                                        • API String ID: 2348918689-2631711097
                                                        • Opcode ID: 6d3c946aa7408266a7d25fb2672dbe8ae8247f2e0de83ff62cccfb8748e94633
                                                        • Instruction ID: 0ad8a2d5834bcf40e3452f351da5690cf7e9735d240cb5ea67a93838737b816d
                                                        • Opcode Fuzzy Hash: 6d3c946aa7408266a7d25fb2672dbe8ae8247f2e0de83ff62cccfb8748e94633
                                                        • Instruction Fuzzy Hash: 7A51A032941367FBCF269BE08C46FEEB666AB00710F154179F900B7191D7B199909AE0
                                                        Function 00DECC91 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 174processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcessId.KERNEL32(76228FB0,00000002,00000000), ref: 00DECC9D
                                                          • Part of subcall function 00DD4D8D: UuidCreate.RPCRT4(?), ref: 00DD4DC0
                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,00DE2401,?,?,00000000,?,?,?), ref: 00DECD7B
                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 00DECD85
                                                        • GetProcessId.KERNEL32(00DE2401,?,?,00000000,?,?,?,?), ref: 00DECDBD
                                                          • Part of subcall function 00DD54DC: lstrlenW.KERNEL32(?,?,00000000,?,00E0B500,?,00000000,?,00DC452F,?,00E0B500), ref: 00DD54FD
                                                          • Part of subcall function 00DD54DC: GetCurrentProcessId.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD5508
                                                          • Part of subcall function 00DD54DC: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD553F
                                                          • Part of subcall function 00DD54DC: ConnectNamedPipe.KERNEL32(?,00000000,?,00DC452F,?,00E0B500), ref: 00DD5554
                                                          • Part of subcall function 00DD54DC: GetLastError.KERNEL32(?,00DC452F,?,00E0B500), ref: 00DD555E
                                                          • Part of subcall function 00DD54DC: Sleep.KERNEL32(00000064,?,00DC452F,?,00E0B500), ref: 00DD5593
                                                          • Part of subcall function 00DD54DC: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55B6
                                                          • Part of subcall function 00DD54DC: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55D1
                                                          • Part of subcall function 00DD54DC: WriteFile.KERNEL32(?,00DC452F,00E0B500,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD55EC
                                                          • Part of subcall function 00DD54DC: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00DC452F,?,00E0B500), ref: 00DD5607
                                                          • Part of subcall function 00E00A28: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00DC4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00E00A38
                                                          • Part of subcall function 00E00A28: GetLastError.KERNEL32(?,?,00DC4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00E00A46
                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00DECBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 00DECE41
                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00DECBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 00DECE50
                                                        • CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,00DECBEF,?,?,?,?,?,00000000,?,?,?), ref: 00DECE67
                                                        Strings
                                                        • Failed to wait for embedded process to connect to pipe., xrefs: 00DECDDF
                                                        • Failed to process messages from embedded message., xrefs: 00DECE04
                                                        • Failed to create embedded pipe name and client token., xrefs: 00DECD00
                                                        • Failed to create embedded process at path: %ls, xrefs: 00DECDB3
                                                        • Failed to allocate embedded command., xrefs: 00DECD54
                                                        • Failed to create embedded pipe., xrefs: 00DECD27
                                                        • burn.embedded, xrefs: 00DECD38
                                                        • Failed to wait for embedded executable: %ls, xrefs: 00DECE24
                                                        • %ls -%ls %ls %ls %u, xrefs: 00DECD40
                                                        • embedded.cpp, xrefs: 00DECDA6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
                                                        • String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
                                                        • API String ID: 875070380-3803182736
                                                        • Opcode ID: 550e821cdc1cb96ff7345d9e4860c4780c1bb293a1460879a350fa31fddd150e
                                                        • Instruction ID: 3c80c90275b9439794fea130cbdebdb640b4f6c60646e1031bc149b7690028ec
                                                        • Opcode Fuzzy Hash: 550e821cdc1cb96ff7345d9e4860c4780c1bb293a1460879a350fa31fddd150e
                                                        • Instruction Fuzzy Hash: 5A517D72D5026DFBDF12AB95DC06BDEBBB9EF04710F101122FA00B6291D7719A418BE0
                                                        Function 00DCECBE Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(?), ref: 00DCEE4C
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • SysFreeString.OLEAUT32(?), ref: 00DCEE04
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeHeapString$AllocateProcess
                                                        • String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`Dv$registration.cpp
                                                        • API String ID: 336948655-2733233106
                                                        • Opcode ID: 53d65fac2ecccdcbabd77ad45e45fd899bfa533a3d4a6f9e34cbea4cfbb4a549
                                                        • Instruction ID: 992f3e626b51674d0cae50daa53a1b88130e52cfa71f8cfca7015373fc52eb6d
                                                        • Opcode Fuzzy Hash: 53d65fac2ecccdcbabd77ad45e45fd899bfa533a3d4a6f9e34cbea4cfbb4a549
                                                        • Instruction Fuzzy Hash: BF5163B5A0171BBBCB11DBA8C981FAEBBA8BF04750B1441ADF915BB250C770DE4087A0
                                                        Function 00E07F7E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00E08468,00000001,?), ref: 00E07F9E
                                                        • CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00E08468,00000001,?), ref: 00E07FB9
                                                        • CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00E08468,00000001,?), ref: 00E07FD4
                                                        • CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00E08468,00000001,?), ref: 00E08040
                                                        • CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00E08468,00000001,?), ref: 00E08064
                                                        • CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00E08468,00000001,?), ref: 00E08088
                                                        • CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00E08468,00000001,?), ref: 00E080A8
                                                        • lstrlenW.KERNEL32(006C0064,?,00E08468,00000001,?), ref: 00E080C3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString$lstrlen
                                                        • String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
                                                        • API String ID: 1657112622-2492263259
                                                        • Opcode ID: 1f68df034acb156eb9b7c3e3382825d96cc2d2e1290787c936dc1415ccafab91
                                                        • Instruction ID: 0cff5842070b937e6d7929a36bc50b1c498be5221ea19765d1c319ef322d076c
                                                        • Opcode Fuzzy Hash: 1f68df034acb156eb9b7c3e3382825d96cc2d2e1290787c936dc1415ccafab91
                                                        • Instruction Fuzzy Hash: 83519131649322BBEB205F54DD45F66BA61EB11B30F209314F6B4BA2D1CBA1E884C7A0
                                                        Function 00DCA03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCA0B6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16
                                                        • String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
                                                        • API String ID: 3613110473-2134270738
                                                        • Opcode ID: a040339c13fc0e53e523d28a9f0d15334c215cfce15fe32c0c255cebee2f1e68
                                                        • Instruction ID: 4f3f326cf2ecb96ef5cafc38c7d1c2a3f318efd6c07343ab46bcde3aa41e22f9
                                                        • Opcode Fuzzy Hash: a040339c13fc0e53e523d28a9f0d15334c215cfce15fe32c0c255cebee2f1e68
                                                        • Instruction Fuzzy Hash: 4B61C832D4022EBBCB119AACCD45F9EBBB8EB05318F18416DF504BB291C232DE409776
                                                        Function 00DD4B2A Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 158sleepfileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00DD4B84
                                                        • GetLastError.KERNEL32 ref: 00DD4B92
                                                        • Sleep.KERNEL32(00000064), ref: 00DD4BB6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorFileLastSleep
                                                        • String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
                                                        • API String ID: 408151869-3212458075
                                                        • Opcode ID: ee33b283702d5a0d807360e5e6d6e4fcda5d36253799c459e834bfcf49d30d6e
                                                        • Instruction ID: 2a13166643508080fd0aa306e40df762912c03d7f3a435b77e4efbfec55b36c5
                                                        • Opcode Fuzzy Hash: ee33b283702d5a0d807360e5e6d6e4fcda5d36253799c459e834bfcf49d30d6e
                                                        • Instruction Fuzzy Hash: B541F976D92632BBDB2156E48D06F5A7664AF10720F120223FE00BB3D0D775DD4096F5
                                                        Function 00DCF585 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00DD04DF,InstallerVersion,InstallerVersion,00000000,00DD04DF,InstallerName,InstallerName,00000000,00DD04DF,Date,InstalledDate,00000000,00DD04DF,LogonUser), ref: 00DCF733
                                                          • Part of subcall function 00E014F4: RegSetValueExW.ADVAPI32(00020006,00E10D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DCF335,00000000,?,00020006), ref: 00E01527
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseValue
                                                        • String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
                                                        • API String ID: 3132538880-2703781546
                                                        • Opcode ID: 3b2cc9ba3678bd98fbb74ed936671ba8482a055a72048bb013cfc69deb66ccf0
                                                        • Instruction ID: 679fe93d54390c0536d1343caa609b32808d815013def64a0880bd7808e852f3
                                                        • Opcode Fuzzy Hash: 3b2cc9ba3678bd98fbb74ed936671ba8482a055a72048bb013cfc69deb66ccf0
                                                        • Instruction Fuzzy Hash: 9C418672A81766B7CF129754CC02FEF7A669B10B10F25116CFA00B72E2C7719EA097A4
                                                        Function 00DDE7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • TlsSetValue.KERNEL32(?,?), ref: 00DDE7FF
                                                        • RegisterClassW.USER32(?), ref: 00DDE82B
                                                        • GetLastError.KERNEL32 ref: 00DDE836
                                                        • CreateWindowExW.USER32(00000080,00E19E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00DDE89D
                                                        • GetLastError.KERNEL32 ref: 00DDE8A7
                                                        • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00DDE945
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                        • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                        • API String ID: 213125376-288575659
                                                        • Opcode ID: 0250104383d1d8cc59217ff42afa37425dbf18282a17bed12e005738ec81e7ad
                                                        • Instruction ID: e85499941b8c4520e5b24351894435b8df0854840f384631312550248b6102d4
                                                        • Opcode Fuzzy Hash: 0250104383d1d8cc59217ff42afa37425dbf18282a17bed12e005738ec81e7ad
                                                        • Instruction Fuzzy Hash: 1E41A372901215AFDB209BA1DC45ADEBFB8FF08760F244126F905BB250D771A984DBF0
                                                        Function 00DEC774 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Failed to allocate memory for pseudo bundle payload hash., xrefs: 00DEC9AD
                                                        • Failed to copy key for passthrough pseudo bundle payload., xrefs: 00DEC9C5
                                                        • Failed to copy cache id for passthrough pseudo bundle., xrefs: 00DECA05
                                                        • Failed to copy filename for passthrough pseudo bundle., xrefs: 00DEC9BE
                                                        • Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00DECAAC
                                                        • Failed to copy local source path for passthrough pseudo bundle., xrefs: 00DEC9B7
                                                        • Failed to copy related arguments for passthrough bundle package, xrefs: 00DECA82
                                                        • Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00DEC7B4
                                                        • Failed to copy download source for passthrough pseudo bundle., xrefs: 00DEC98F
                                                        • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00DEC9E7
                                                        • Failed to copy install arguments for passthrough bundle package, xrefs: 00DECA62
                                                        • Failed to recreate command-line arguments., xrefs: 00DECA43
                                                        • Failed to copy key for passthrough pseudo bundle., xrefs: 00DEC988
                                                        • pseudobundle.cpp, xrefs: 00DEC7A8, 00DEC9A1, 00DEC9DB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
                                                        • API String ID: 1357844191-115096447
                                                        • Opcode ID: 8a1ea473a9fa67224feaddff888101a5d9a93b29d08ed17b90ebb07bd3f02279
                                                        • Instruction ID: 2720fcec0fa9d2e0ec2a47358a2f18e2d8acb7d76c900da1693fa064d909bb55
                                                        • Opcode Fuzzy Hash: 8a1ea473a9fa67224feaddff888101a5d9a93b29d08ed17b90ebb07bd3f02279
                                                        • Instruction Fuzzy Hash: BCB16835A10656EFCB11EF29C881F55BBA1FF08710F159169ED18AB352CB31E822DFA0
                                                        Function 00DEDE46 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 00DEDE61
                                                        Strings
                                                        • Failed to initialize BITS job callback., xrefs: 00DEDF82
                                                        • bitsuser.cpp, xrefs: 00DEDE77, 00DEDF6A
                                                        • Failed to copy download URL., xrefs: 00DEDEA8
                                                        • Failed to add file to BITS job., xrefs: 00DEDF2E
                                                        • Failed to download BITS job., xrefs: 00DEDFF8
                                                        • Invalid BITS user URL: %ls, xrefs: 00DEDE83
                                                        • Failed to create BITS job callback., xrefs: 00DEDF74
                                                        • Falied to start BITS job., xrefs: 00DEE019
                                                        • Failed to set credentials for BITS job., xrefs: 00DEDF0F
                                                        • Failed to set callback interface for BITS job., xrefs: 00DEDF99
                                                        • Failed to complete BITS job., xrefs: 00DEE00B
                                                        • Failed while waiting for BITS download., xrefs: 00DEE012
                                                        • Failed to create BITS job., xrefs: 00DEDEF0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen
                                                        • String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS user URL: %ls$bitsuser.cpp
                                                        • API String ID: 1659193697-2382896028
                                                        • Opcode ID: c355b80ede03d742636ac28b1a762f38324b7fc76b194c986b7740943622895f
                                                        • Instruction ID: b415b3b7a56de1d13fb57537b20efca38a89de9cdcd81a65f2e6e61aa0d86dcf
                                                        • Opcode Fuzzy Hash: c355b80ede03d742636ac28b1a762f38324b7fc76b194c986b7740943622895f
                                                        • Instruction Fuzzy Hash: BC61A331A003A5EBCB21AB95D885E6E7BB5EF08B20B154155FC05FF292DBB1DD009BB0
                                                        Function 00DCBC93 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 190processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCBCE5
                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 00DCBDF2
                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 00DCBDFC
                                                        • WaitForInputIdle.USER32(?,?), ref: 00DCBE50
                                                        • CloseHandle.KERNEL32(?,?,?), ref: 00DCBE9B
                                                        • CloseHandle.KERNEL32(?,?,?), ref: 00DCBEA8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
                                                        • String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
                                                        • API String ID: 155678114-2737401750
                                                        • Opcode ID: 800c7caa8d480b551ba5ab68893cb47768718f0e0131904bfde7dec4446c65b9
                                                        • Instruction ID: 8032c138e6a7c00ee07662d58e9770f6ba3f0cf1428003d47019fb32b51b93a8
                                                        • Opcode Fuzzy Hash: 800c7caa8d480b551ba5ab68893cb47768718f0e0131904bfde7dec4446c65b9
                                                        • Instruction Fuzzy Hash: 65513C72D0061ABBCF21AF90CC42EAEBB78FF04720F14456AFA15B3151D7319E509BA1
                                                        Function 00DE69D2 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 153serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00DE6F28,?), ref: 00DE6A0B
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DE6F28,?,?,?), ref: 00DE6A18
                                                        • OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00DE6F28,?,?,?), ref: 00DE6A60
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DE6F28,?,?,?), ref: 00DE6A6C
                                                        • QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00DE6F28,?,?,?), ref: 00DE6AA6
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00DE6F28,?,?,?), ref: 00DE6AB0
                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00DE6B67
                                                        • CloseServiceHandle.ADVAPI32(?), ref: 00DE6B71
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
                                                        • String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuuser.cpp$wuauserv
                                                        • API String ID: 971853308-301359130
                                                        • Opcode ID: 169511a39e280dffebfd29c94c1c4a84439629cce57f164d0db6938139b56ac9
                                                        • Instruction ID: 8c8fc1af4d05d94f488ca1fa09a833c6030fafff081eca1c78fb58fc58dd25ec
                                                        • Opcode Fuzzy Hash: 169511a39e280dffebfd29c94c1c4a84439629cce57f164d0db6938139b56ac9
                                                        • Instruction Fuzzy Hash: 3C41C372E44365ABD721ABA68C45EAFBBA4EF64760F058425FD01FB241E771DC408AB0
                                                        Function 00DD3B4E Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 130COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00DD3BA2
                                                        • GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00DD3BAC
                                                        • GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00DD3C15
                                                        • ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00DD3C1C
                                                        • CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00DD3CA6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
                                                        • String ID: 4#v$%u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
                                                        • API String ID: 2407829081-4287186919
                                                        • Opcode ID: a20f165aa8301733e7d1af89773da5a28ed047f31820aec8d4d1ecdf1ff2c76c
                                                        • Instruction ID: e524098d13025f3d6ff1dad3869a52caa8effe3afdf3bc279e55b49a5c5b70d0
                                                        • Opcode Fuzzy Hash: a20f165aa8301733e7d1af89773da5a28ed047f31820aec8d4d1ecdf1ff2c76c
                                                        • Instruction Fuzzy Hash: D9418172E8123DABCB209B64DC49FDA7778AB14710F110196F908B7241EA709F858BE1
                                                        Function 00DCA28B Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCA2B3
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCA30E
                                                        • RegQueryValueExW.ADVAPI32(000002C0,00000100,00000000,000002C0,00000000,00000000,000002C0,?,00000100,00000000,?,00000000,?,000002C0,000002C0,?), ref: 00DCA32F
                                                        • RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,00000100,00000000,000002C0), ref: 00DCA405
                                                        Strings
                                                        • Failed to query registry key value., xrefs: 00DCA36A
                                                        • Failed to format key string., xrefs: 00DCA2BE
                                                        • RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00DCA3DD
                                                        • Failed to set variable., xrefs: 00DCA3BD
                                                        • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00DCA37A
                                                        • Registry key not found. Key = '%ls', xrefs: 00DCA396
                                                        • search.cpp, xrefs: 00DCA360
                                                        • Failed to open registry key. Key = '%ls', xrefs: 00DCA3C7
                                                        • Failed to format value string., xrefs: 00DCA319
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16$CloseQueryValue
                                                        • String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
                                                        • API String ID: 2702208347-46557908
                                                        • Opcode ID: 3a938cd63a7ce971a85c4a73c40f00a124bcce3de58c2fe7f6d640c72bc71332
                                                        • Instruction ID: 31c9cc8829a94ed2b1f3aac9e161181dfc551ca80c33ed1d2d7ce579aba27eb3
                                                        • Opcode Fuzzy Hash: 3a938cd63a7ce971a85c4a73c40f00a124bcce3de58c2fe7f6d640c72bc71332
                                                        • Instruction Fuzzy Hash: 7741E732D4022ABBDF126AD8CC06FAEBB64EB04710F154269F804B7192D7719E50ABB1
                                                        Function 00DCB208 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 137COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,00DCBAFB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB210
                                                        • GetLastError.KERNEL32(?,00DCBAFB,00000008,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00DCB21C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorHandleLastModule
                                                        • String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
                                                        • API String ID: 4242514867-926796631
                                                        • Opcode ID: 5ed7c7d91dae2a14f795aa3752f68591a9b4481181f8dbb7e0c28acc0f4798d2
                                                        • Instruction ID: e34066bff2d81fadc9e97dfc2d24ba24a3751f54c1ef63a40f97314ad68ffc16
                                                        • Opcode Fuzzy Hash: 5ed7c7d91dae2a14f795aa3752f68591a9b4481181f8dbb7e0c28acc0f4798d2
                                                        • Instruction Fuzzy Hash: 8E41F732280712A7C73126919C47F6F6655EF85B31F79852EF9017F2C2D765C88282F9
                                                        Function 00DC694B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 133libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00DC699B
                                                        • GetLastError.KERNEL32 ref: 00DC69A5
                                                        • GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00DC69E8
                                                        • GetLastError.KERNEL32 ref: 00DC69F2
                                                        • FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00DC6B03
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
                                                        • String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
                                                        • API String ID: 3057421322-109962352
                                                        • Opcode ID: bb4435c9bc29b29dddf655fed7a1a6b5d6fab79a152020ad49b6c8e4542c5cb2
                                                        • Instruction ID: 7f97510f49f440de19fd2b7ff9db230c0c5b74805c29793ceabcb648a5db9496
                                                        • Opcode Fuzzy Hash: bb4435c9bc29b29dddf655fed7a1a6b5d6fab79a152020ad49b6c8e4542c5cb2
                                                        • Instruction Fuzzy Hash: 0E41A272D4123A9BDB219B658C45FEABAA4FF08710F044199E948F7181E775CE84CBF0
                                                        Function 00DC48EF Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130memorysynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00DC5466,?,?,?,?), ref: 00DC4920
                                                        • GetLastError.KERNEL32(?,?,?,00DC5466,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DC4931
                                                        • ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DC4A6E
                                                        • CloseHandle.KERNEL32(?,?,?,?,00DC5466,?,?,?,?,?,?,?,?,?,?,?), ref: 00DC4A77
                                                        Strings
                                                        • Failed to pump messages from parent process., xrefs: 00DC4A42
                                                        • Failed to create the message window., xrefs: 00DC49CC
                                                        • Failed to set elevated pipe into thread local storage for logging., xrefs: 00DC49A8
                                                        • comres.dll, xrefs: 00DC49DD
                                                        • user.cpp, xrefs: 00DC4955, 00DC499E
                                                        • Failed to connect to unelevated process., xrefs: 00DC4916
                                                        • Failed to allocate thread local storage for logging., xrefs: 00DC495F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AllocCloseErrorHandleLastMutexRelease
                                                        • String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$user.cpp
                                                        • API String ID: 687263955-1790235126
                                                        • Opcode ID: 1435292288a6e20612c764c667d4ffc6945fa60e05cff0867b3e6558593f8068
                                                        • Instruction ID: 58d252643524f9e3756b1344ec401e8bf1b4136dcba8be9e22107fc037ce9615
                                                        • Opcode Fuzzy Hash: 1435292288a6e20612c764c667d4ffc6945fa60e05cff0867b3e6558593f8068
                                                        • Instruction Fuzzy Hash: 86419373940626BBC7129BA0CC45FEFBA6CFF04710F01122ABA55F7150DB31A9908AF0
                                                        Function 00DC7FA5 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 216COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000,00000000,00000000,00000001,00000000,00000002,000000B9), ref: 00DC7FC2
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DC81EA
                                                        Strings
                                                        • Unsupported variable type., xrefs: 00DC81A7
                                                        • Failed to write variable value type., xrefs: 00DC81CA
                                                        • Failed to write variable count., xrefs: 00DC7FDD
                                                        • Failed to get version., xrefs: 00DC819B
                                                        • Failed to get string., xrefs: 00DC81B5
                                                        • Failed to write variable value as number., xrefs: 00DC8194
                                                        • Failed to write variable name., xrefs: 00DC81D1
                                                        • Failed to write variable value as string., xrefs: 00DC81AE
                                                        • Failed to get numeric., xrefs: 00DC81BC
                                                        • Failed to write included flag., xrefs: 00DC81D8
                                                        • Failed to write literal flag., xrefs: 00DC81C3
                                                        • feclient.dll, xrefs: 00DC809D, 00DC80F3, 00DC8134
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
                                                        • API String ID: 3168844106-2118673349
                                                        • Opcode ID: fd762b09ea388bdd5ca833f5337e08dfbf88ad2575b850931f0edb7367e1f94d
                                                        • Instruction ID: c877d7da91524ede3e9f3462be3571f40b033d824c493198f4398f13df1675ee
                                                        • Opcode Fuzzy Hash: fd762b09ea388bdd5ca833f5337e08dfbf88ad2575b850931f0edb7367e1f94d
                                                        • Instruction Fuzzy Hash: 17716E72D0472BABCB129EA4CC41FAE7BA5FF04350F19816AE90167190DB30DD56ABB0
                                                        Function 00E002F8 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 123COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00E0033C
                                                        • GetComputerNameW.KERNEL32(?,?), ref: 00E00394
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Name$ComputerFileModule
                                                        • String ID: --- logging level: %hs ---$8d$=== Logging started: %ls ===$@d$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Hd$Td$\d$dd
                                                        • API String ID: 2577110986-1922370346
                                                        • Opcode ID: 42fa9816adcc8f6ee674c61192241f4b54e0983da53ddccb8e3ff1134a4e93d2
                                                        • Instruction ID: 2d630d9f4bf557c8d543e2294a0b13647cd46140d762541a34a7d65192f03996
                                                        • Opcode Fuzzy Hash: 42fa9816adcc8f6ee674c61192241f4b54e0983da53ddccb8e3ff1134a4e93d2
                                                        • Instruction Fuzzy Hash: 4541A1B29001189FCB209F65EC45BEA73BCEB44304F4451BAEA19B3182D6749EC58FA8
                                                        Function 00DD97B2 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,00DDA843,00000000,00000000,00000000,?,00000000), ref: 00DD97CD
                                                        • GetLastError.KERNEL32(?,00DDA843,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00DD97DD
                                                          • Part of subcall function 00E04102: Sleep.KERNEL32(?,00000000,?,00DD85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00DC4DBC), ref: 00E04119
                                                        • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 00DD98E9
                                                        Strings
                                                        • Failed to open payload in working path: %ls, xrefs: 00DD980C
                                                        • Moving, xrefs: 00DD987F
                                                        • Copying, xrefs: 00DD9888, 00DD9893
                                                        • Failed to verify payload hash: %ls, xrefs: 00DD9875
                                                        • Failed to copy %ls to %ls, xrefs: 00DD98D7
                                                        • Failed to move %ls to %ls, xrefs: 00DD98C1
                                                        • %ls payload from working path '%ls' to path '%ls', xrefs: 00DD9894
                                                        • Failed to verify payload signature: %ls, xrefs: 00DD9838
                                                        • cache.cpp, xrefs: 00DD9801
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorFileHandleLastSleep
                                                        • String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
                                                        • API String ID: 1275171361-1604654059
                                                        • Opcode ID: 0443c739d404f6d4f6bffc9a98bc5aeac17b6602e61c15f42a42696efbfa8e9b
                                                        • Instruction ID: 656451c1a19fc9795f251d7a3933c7affc04e15fd000eb4c5ea8f2150f44b2d3
                                                        • Opcode Fuzzy Hash: 0443c739d404f6d4f6bffc9a98bc5aeac17b6602e61c15f42a42696efbfa8e9b
                                                        • Instruction Fuzzy Hash: A531EC72A41230BBDA322A558C5AF6FAA6CEF42F50F050116FD157B391D663DC40A6F1
                                                        Function 00DC65C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000000), ref: 00DC65FC
                                                          • Part of subcall function 00E00ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00DC5EB2,00000000), ref: 00E00AE0
                                                          • Part of subcall function 00E00ACC: GetProcAddress.KERNEL32(00000000), ref: 00E00AE7
                                                          • Part of subcall function 00E00ACC: GetLastError.KERNEL32(?,?,?,00DC5EB2,00000000), ref: 00E00AFE
                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DC6628
                                                        • GetLastError.KERNEL32 ref: 00DC6636
                                                        • GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 00DC666E
                                                        • GetLastError.KERNEL32 ref: 00DC6678
                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00DC66BB
                                                        • GetLastError.KERNEL32 ref: 00DC66C5
                                                        Strings
                                                        • Failed to get 32-bit system folder., xrefs: 00DC66A6
                                                        • Failed to backslash terminate system folder., xrefs: 00DC6708
                                                        • variable.cpp, xrefs: 00DC665A, 00DC669C
                                                        • Failed to set system folder variant value., xrefs: 00DC6724
                                                        • Failed to get 64-bit system folder., xrefs: 00DC6664
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
                                                        • String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
                                                        • API String ID: 325818893-1590374846
                                                        • Opcode ID: 6a4a62a07747d2a5291807b96633458c823896d18336c7f28ae901b8f6eac7e2
                                                        • Instruction ID: e3822a621740859ca15775036e1cd2be1b2f36aa4c84f1ded904471e3579fbd1
                                                        • Opcode Fuzzy Hash: 6a4a62a07747d2a5291807b96633458c823896d18336c7f28ae901b8f6eac7e2
                                                        • Instruction Fuzzy Hash: 0F310672D81336ABDB209BA18C49F9B77A8AF00750F1545A9BD04BB1C1D774DD848AF1
                                                        Function 00DD3F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DD3AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00DD3FB5,feclient.dll,?,00000000,?,?,?,00DC4B12), ref: 00DD3B42
                                                        • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00DC4B12,?,?,00E0B488,?,00000001,00000000,00000000), ref: 00DD404C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseSleep
                                                        • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                        • API String ID: 2834455192-2673269691
                                                        • Opcode ID: cda5c74c07d8ca43b2a99d0babe702344d695b9fe5e7df43845d5208e98a6b1d
                                                        • Instruction ID: f41c890c62db5bd0dbfa95b8e3766bf8d306440bc2d85d126ceb7ce248ee2e2f
                                                        • Opcode Fuzzy Hash: cda5c74c07d8ca43b2a99d0babe702344d695b9fe5e7df43845d5208e98a6b1d
                                                        • Instruction Fuzzy Hash: EA617F71A00716ABDB269F74CC46B7A7BA8EF14350B094166F901EB290E771EE9087B1
                                                        Function 00DC6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000001,?,00000000,00DC5445,00000006,?,00DC82B9,?,?,?,00000000,00000000,00000001), ref: 00DC6DC8
                                                          • Part of subcall function 00DC56A9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00DC6595,00DC6595,?,00DC563D,?,?,00000000), ref: 00DC56E5
                                                          • Part of subcall function 00DC56A9: GetLastError.KERNEL32(?,00DC563D,?,?,00000000,?,?,00DC6595,?,00DC7F02,?,?,?,?,?), ref: 00DC5714
                                                        • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,00DC82B9), ref: 00DC6F59
                                                        Strings
                                                        • Setting string variable '%ls' to value '%ls', xrefs: 00DC6EED
                                                        • Setting hidden variable '%ls', xrefs: 00DC6E86
                                                        • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00DC6F6B
                                                        • Unsetting variable '%ls', xrefs: 00DC6F15
                                                        • Failed to set value of variable: %ls, xrefs: 00DC6F41
                                                        • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00DC6ED0
                                                        • Failed to find variable value '%ls'., xrefs: 00DC6DE3
                                                        • Attempt to set built-in variable value: %ls, xrefs: 00DC6E56
                                                        • Failed to insert variable '%ls'., xrefs: 00DC6E0D
                                                        • Setting numeric variable '%ls' to value %lld, xrefs: 00DC6EFA
                                                        • variable.cpp, xrefs: 00DC6E4B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                        • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                        • API String ID: 2716280545-445000439
                                                        • Opcode ID: c5e59d1b1943186727ec407115586c2a7c2d42fc41b170e549a4cd6e5607c5c5
                                                        • Instruction ID: d7fb89718a1b1398338c92cf39a56383bab567ade636074fbf26486c9ffd8f6c
                                                        • Opcode Fuzzy Hash: c5e59d1b1943186727ec407115586c2a7c2d42fc41b170e549a4cd6e5607c5c5
                                                        • Instruction Fuzzy Hash: 3151F4B1A40226ABDB309F55DC4AF6B7BA8EF55700F24511EF885672C2C275D881CBF1
                                                        Function 00DD2C1C Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 299COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00DD2C8A
                                                        Strings
                                                        • Failed to add registration action for self dependent., xrefs: 00DD2F57
                                                        • Failed to add dependent bundle provider key to ignore dependents., xrefs: 00DD2DF4
                                                        • Failed to add registration action for dependent related bundle., xrefs: 00DD2F8E
                                                        • Failed to allocate registration action., xrefs: 00DD2CF3
                                                        • Failed to add self-dependent to ignore dependents., xrefs: 00DD2D0E
                                                        • Failed to check for remaining dependents during planning., xrefs: 00DD2E30
                                                        • Failed to add dependents ignored from command-line., xrefs: 00DD2D3F
                                                        • crypt32.dll, xrefs: 00DD2CD5, 00DD2DCF, 00DD2EC4, 00DD2F39
                                                        • Failed to create the string dictionary., xrefs: 00DD2CC3
                                                        • wininet.dll, xrefs: 00DD2ED7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
                                                        • API String ID: 1825529933-1705955799
                                                        • Opcode ID: 0a00dac404576d44af27aab0e701fd61b73c8744538985311b0433d04c8db7eb
                                                        • Instruction ID: 57814446153735a665f5516e6eea0fd4cfd834ae72ce8abfc56d83e99d9fe06c
                                                        • Opcode Fuzzy Hash: 0a00dac404576d44af27aab0e701fd61b73c8744538985311b0433d04c8db7eb
                                                        • Instruction Fuzzy Hash: EBB16A70A04216EBCB299F29C841BBA7BB5FF24711F14856AF815AB351D730D9A0CBF1
                                                        Function 00DDF90B Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 187COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DDF947
                                                        • UuidCreate.RPCRT4(?), ref: 00DDFA2A
                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 00DDFA4B
                                                        • LeaveCriticalSection.KERNEL32(?,?), ref: 00DDFAF4
                                                        Strings
                                                        • Failed to default local update source, xrefs: 00DDF9B7
                                                        • Failed to convert bundle update guid into string., xrefs: 00DDFA6A
                                                        • Failed to create bundle update guid., xrefs: 00DDFA37
                                                        • Failed to set update bundle., xrefs: 00DDFACE
                                                        • update\%ls, xrefs: 00DDF9A3
                                                        • Failed to recreate command-line for update bundle., xrefs: 00DDFA12
                                                        • userForApplication.cpp, xrefs: 00DDFA60
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$CreateEnterFromLeaveStringUuid
                                                        • String ID: userForApplication.cpp$Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
                                                        • API String ID: 171215650-2594647487
                                                        • Opcode ID: 5d1e1faad330b58691bbf8c6a1c9fc1360421d5d797a00769d17483bf1bce566
                                                        • Instruction ID: 8bbe18b650f02f6a3d8b40fdabbda3dd6eafb589c6c05cd49ad920c07a885911
                                                        • Opcode Fuzzy Hash: 5d1e1faad330b58691bbf8c6a1c9fc1360421d5d797a00769d17483bf1bce566
                                                        • Instruction Fuzzy Hash: 11617D31A41215AFCF219FA4C845FAEBBB5EF08710F19417AF80AAB252D7719C40CFA1
                                                        Function 00DC4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(?), ref: 00DC4C64
                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00DC4C75
                                                        Strings
                                                        • Failed to open log., xrefs: 00DC4B18
                                                        • Failed to create the message window., xrefs: 00DC4B98
                                                        • Failed to set action variables., xrefs: 00DC4BC4
                                                        • Failed to check global conditions, xrefs: 00DC4B49
                                                        • Failed while running , xrefs: 00DC4C2A
                                                        • WixBundleLayoutDirectory, xrefs: 00DC4BF5
                                                        • Failed to set layout directory variable to value provided from command-line., xrefs: 00DC4C06
                                                        • Failed to query registration., xrefs: 00DC4BAE
                                                        • Failed to set registration variables., xrefs: 00DC4BDE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: MessagePostWindow
                                                        • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                        • API String ID: 3618638489-3051724725
                                                        • Opcode ID: 09980e13d9cc07f6c2e26356a7e0bd76c093f4cd2563a13c3d22304d4408e8bb
                                                        • Instruction ID: 21ec2c1620771d8a7d0ae8097d3d837926b7430efde35c313e13568a72dc3e7c
                                                        • Opcode Fuzzy Hash: 09980e13d9cc07f6c2e26356a7e0bd76c093f4cd2563a13c3d22304d4408e8bb
                                                        • Instruction Fuzzy Hash: F3410A31641A1BBBDB265A60CE65FBAF66CFF00750F04421AF804A7260EBB0EC5097F0
                                                        Function 00DDF051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 00DDF06E
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DDF19B
                                                        Strings
                                                        • Failed to copy the arguments., xrefs: 00DDF12D
                                                        • UX requested unknown approved exe with id: %ls, xrefs: 00DDF0CE
                                                        • Failed to post launch approved exe message., xrefs: 00DDF186
                                                        • user is active, cannot change user state., xrefs: 00DDF089
                                                        • userForApplication.cpp, xrefs: 00DDF17C
                                                        • Failed to copy the id., xrefs: 00DDF100
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalHeapSection$AllocateEnterLeaveProcess
                                                        • String ID: user is active, cannot change user state.$userForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
                                                        • API String ID: 1367039788-528931743
                                                        • Opcode ID: 5c0dcd2b8fe813f7fbc932e9cf5ac9c21b133081d97436c1f64ead90917ab478
                                                        • Instruction ID: 08906d45d74b7ef92dc8c74aaa2e0497b7cfb1dd1e626ba3408475a3efb24c5d
                                                        • Opcode Fuzzy Hash: 5c0dcd2b8fe813f7fbc932e9cf5ac9c21b133081d97436c1f64ead90917ab478
                                                        • Instruction Fuzzy Hash: 5C318F72A41326EFDB219F64DC05EAA77A8EF04720B058566FD06FB351EB71DD4086B0
                                                        Function 00DD969D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,00DDA7D4,00000000,00000000,00000000,?,00000000), ref: 00DD96B8
                                                        • GetLastError.KERNEL32(?,00DDA7D4,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00DD96C6
                                                          • Part of subcall function 00E04102: Sleep.KERNEL32(?,00000000,?,00DD85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00DC4DBC), ref: 00E04119
                                                        • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 00DD97A4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorFileHandleLastSleep
                                                        • String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
                                                        • API String ID: 1275171361-1187406825
                                                        • Opcode ID: d3d1f8f24b3a91805e12079635381dee5ea4593c51dcc515cbde534c21d4433f
                                                        • Instruction ID: 16463fc6dad873c31617baf80e7efcf1203e431265e9caa43909ff779b3d62f7
                                                        • Opcode Fuzzy Hash: d3d1f8f24b3a91805e12079635381dee5ea4593c51dcc515cbde534c21d4433f
                                                        • Instruction Fuzzy Hash: D62137B2A803247BD6321A158C56FAB656CDF41F60F141116FE54BB3D1D2A3DC81C6F1
                                                        Function 00DC6F85 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DC6FB2
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DC71BE
                                                        Strings
                                                        • Unsupported variable type., xrefs: 00DC7184
                                                        • Failed to read variable value as number., xrefs: 00DC7178
                                                        • Failed to read variable count., xrefs: 00DC6FD2
                                                        • Failed to read variable literal flag., xrefs: 00DC7199
                                                        • Failed to read variable value type., xrefs: 00DC71A0
                                                        • Failed to set variable., xrefs: 00DC7192
                                                        • Failed to read variable value as string., xrefs: 00DC718B
                                                        • Failed to read variable included flag., xrefs: 00DC71AE
                                                        • Failed to set variable value., xrefs: 00DC7171
                                                        • Failed to read variable name., xrefs: 00DC71A7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
                                                        • API String ID: 3168844106-528957463
                                                        • Opcode ID: 83238799f0508e0f62accec47ccbc6cec5af968d229624f8339e888201930273
                                                        • Instruction ID: 64559df77949008fc820f7e531a9fae7556875ce01c8710317a4525ee12583d6
                                                        • Opcode Fuzzy Hash: 83238799f0508e0f62accec47ccbc6cec5af968d229624f8339e888201930273
                                                        • Instruction Fuzzy Hash: ED715972C0925BABDF129AA4CD45FAEBBB9EF04750F185129B900A71A0D631DE509FB0
                                                        Function 00E044D1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00E04550
                                                        • GetLastError.KERNEL32 ref: 00E04566
                                                        • GetFileSizeEx.KERNEL32(00000000,?), ref: 00E045BF
                                                        • GetLastError.KERNEL32 ref: 00E045C9
                                                        • SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00E0461D
                                                        • GetLastError.KERNEL32 ref: 00E04628
                                                        • ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00E04717
                                                        • CloseHandle.KERNEL32(?), ref: 00E0478A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 3286166115-2967768451
                                                        • Opcode ID: 09394b4ef96abb7455945d1695eafccc3a744490d4727086cec6e2e2c802960d
                                                        • Instruction ID: 17f0b9c1f14f12d74da16a3c45f25322a4ad74190871782fd94a0170fb65a348
                                                        • Opcode Fuzzy Hash: 09394b4ef96abb7455945d1695eafccc3a744490d4727086cec6e2e2c802960d
                                                        • Instruction Fuzzy Hash: 1D8136F2A40226EBDB218E599E41BAB3698EF41724F15511AFF55FB2C0E771CD8086E0
                                                        Function 00DC3076 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 00DC30C1
                                                        • GetLastError.KERNEL32 ref: 00DC30C7
                                                        • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00DC3121
                                                        • GetLastError.KERNEL32 ref: 00DC3127
                                                        • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC31DB
                                                        • GetLastError.KERNEL32 ref: 00DC31E5
                                                        • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DC323B
                                                        • GetLastError.KERNEL32 ref: 00DC3245
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
                                                        • String ID: @$pathutil.cpp
                                                        • API String ID: 1547313835-3022285739
                                                        • Opcode ID: c6cb509c37cf1687080c3cab4ba7bf4af82a5a0fae7cc77072c0fb9a1db92ad8
                                                        • Instruction ID: f0b8ae78dd00d2588e374f6859d2bff9f87f9c6e1a07550eb6db65b95cbf297e
                                                        • Opcode Fuzzy Hash: c6cb509c37cf1687080c3cab4ba7bf4af82a5a0fae7cc77072c0fb9a1db92ad8
                                                        • Instruction Fuzzy Hash: 0361B273D0022BABDF219AE58844F9EBBA8AF04750F158169EE41BB250E735DF4097F4
                                                        Function 00DC2DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00DC2E5F
                                                        • GetLastError.KERNEL32 ref: 00DC2E69
                                                        • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00DC2F09
                                                        • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00DC2F96
                                                        • GetLastError.KERNEL32 ref: 00DC2FA3
                                                        • Sleep.KERNEL32(00000064), ref: 00DC2FB7
                                                        • CloseHandle.KERNEL32(?), ref: 00DC301F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                        • String ID: 4#v$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                        • API String ID: 3480017824-1777530710
                                                        • Opcode ID: 45a9d1e14b5770ca202f1ec6a44f9f97e81bb36aee9e0f0c986b40f9b4179910
                                                        • Instruction ID: 7e88bbac955196632fb4355ac75f703ee4dfa59bb47f0341689463be0aa32501
                                                        • Opcode Fuzzy Hash: 45a9d1e14b5770ca202f1ec6a44f9f97e81bb36aee9e0f0c986b40f9b4179910
                                                        • Instruction Fuzzy Hash: 47716372D0122AABDB319F55DC49FAAB3B8AF08710F144199F914B7290D7759E809FB0
                                                        Function 00E06D50 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 165COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7622DFD0,?,00E072C8,?,?), ref: 00E06DA6
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06E11
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06E89
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06EC8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$Free$Compare
                                                        • String ID: `Dv$label$scheme$term
                                                        • API String ID: 1324494773-22456348
                                                        • Opcode ID: c3a79cf10135f0627f3514056ee0269cb7a3c38523acd40112e564d39ec99915
                                                        • Instruction ID: 0226b61a730d5d6c17fcd33cb002b11aa35fd980646ed3e58244e6c58728ed4d
                                                        • Opcode Fuzzy Hash: c3a79cf10135f0627f3514056ee0269cb7a3c38523acd40112e564d39ec99915
                                                        • Instruction Fuzzy Hash: 5A516C39901219EFCB15DB94C845FAEBBB8EF04725F2412A9E511B61E0D7319FA0DB50
                                                        Function 00DD4D8D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • UuidCreate.RPCRT4(?), ref: 00DD4DC0
                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 00DD4DEF
                                                        • UuidCreate.RPCRT4(?), ref: 00DD4E3A
                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 00DD4E66
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateFromStringUuid
                                                        • String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
                                                        • API String ID: 4041566446-2510341293
                                                        • Opcode ID: f44096a67de541306dd8a411ca81c8a58a69144985cbd7d9a274ea2b13d396f0
                                                        • Instruction ID: a1353c197392f580779fcf4993318f4bd0a5371b780e0741f94534c68383eb55
                                                        • Opcode Fuzzy Hash: f44096a67de541306dd8a411ca81c8a58a69144985cbd7d9a274ea2b13d396f0
                                                        • Instruction Fuzzy Hash: CE417BB2D40308ABCB21EBE5CD05EDEB7F8AB44710F20412AF905BB390D7759985CBA0
                                                        Function 00DDEA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00DC548E,?,?), ref: 00DDEA9D
                                                        • GetLastError.KERNEL32(?,00DC548E,?,?), ref: 00DDEAAA
                                                        • CreateThread.KERNEL32(00000000,00000000,00DDE7B4,?,00000000,00000000), ref: 00DDEB03
                                                        • GetLastError.KERNEL32(?,00DC548E,?,?), ref: 00DDEB10
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00DC548E,?,?), ref: 00DDEB4B
                                                        • CloseHandle.KERNEL32(00000000,?,00DC548E,?,?), ref: 00DDEB6A
                                                        • CloseHandle.KERNEL32(?,?,00DC548E,?,?), ref: 00DDEB77
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                        • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                        • API String ID: 2351989216-3599963359
                                                        • Opcode ID: 35be5ec51353ba5b576bef46c6c663e6c5ada3706234fd1954f2e6e85029c669
                                                        • Instruction ID: bfa543ae3b02f70a0a2454bbebf6e2d0f674c366747e4cf3bf5d1766efaf6b12
                                                        • Opcode Fuzzy Hash: 35be5ec51353ba5b576bef46c6c663e6c5ada3706234fd1954f2e6e85029c669
                                                        • Instruction Fuzzy Hash: 52319276E0122ABFD711AF998D85A9FBBA8FF04750F11016AB904FB340E7309E4086B0
                                                        Function 00DDE645 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00DC548E,?,?), ref: 00DDE666
                                                        • GetLastError.KERNEL32(?,?,00DC548E,?,?), ref: 00DDE673
                                                        • CreateThread.KERNEL32(00000000,00000000,00DDE3C8,00000000,00000000,00000000), ref: 00DDE6D2
                                                        • GetLastError.KERNEL32(?,?,00DC548E,?,?), ref: 00DDE6DF
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00DC548E,?,?), ref: 00DDE71A
                                                        • CloseHandle.KERNEL32(?,?,?,00DC548E,?,?), ref: 00DDE72E
                                                        • CloseHandle.KERNEL32(?,?,?,00DC548E,?,?), ref: 00DDE73B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                        • String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
                                                        • API String ID: 2351989216-1977201954
                                                        • Opcode ID: a28a9fc13a69aa7235646f9f0cf99a16537b136effc66567e2493bbb64475153
                                                        • Instruction ID: befc0d5ccebd8a2e67844fb0904b6ef19cc4c0ab90a017a0d959e4103316fe3b
                                                        • Opcode Fuzzy Hash: a28a9fc13a69aa7235646f9f0cf99a16537b136effc66567e2493bbb64475153
                                                        • Instruction Fuzzy Hash: 63317276D0022ABFDB219B99CC05A9FBBB8EF44710F114166FD10FB251E77199408AF0
                                                        Function 00DE14E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,76232F60,?,?,00DC5405,00DC53BD,00000000,00DC5445), ref: 00DE1506
                                                        • GetLastError.KERNEL32 ref: 00DE1519
                                                        • GetExitCodeThread.KERNEL32(00E0B488,?), ref: 00DE155B
                                                        • GetLastError.KERNEL32 ref: 00DE1569
                                                        • ResetEvent.KERNEL32(00E0B460), ref: 00DE15A4
                                                        • GetLastError.KERNEL32 ref: 00DE15AE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                        • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                        • API String ID: 2979751695-3400260300
                                                        • Opcode ID: ddc6064ef172ae8cb1bcc1d940c712ae5a17d55e3d130ab3085857b13e68c0a8
                                                        • Instruction ID: da48fe79063d8976263e5e3ee0e4a76b933bfdae22db536cd656fbac08cff176
                                                        • Opcode Fuzzy Hash: ddc6064ef172ae8cb1bcc1d940c712ae5a17d55e3d130ab3085857b13e68c0a8
                                                        • Instruction Fuzzy Hash: CC318F74B41346EBD710AF668D01ABF76F8FB44710B10416AF946EA160E731DA409B71
                                                        Function 00DE15FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEvent.KERNEL32(00E0B478,?,00000000,?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000,?), ref: 00DE161B
                                                        • GetLastError.KERNEL32(?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000,?,00DC5489,FFF9E89D,00DC5489), ref: 00DE1625
                                                        • WaitForSingleObject.KERNEL32(00E0B488,000000FF,?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000,?,00DC5489), ref: 00DE165F
                                                        • GetLastError.KERNEL32(?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000,?,00DC5489,FFF9E89D,00DC5489), ref: 00DE1669
                                                        • CloseHandle.KERNEL32(00000000,00DC5489,?,00000000,?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000), ref: 00DE16B4
                                                        • CloseHandle.KERNEL32(00000000,00DC5489,?,00000000,?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000), ref: 00DE16C3
                                                        • CloseHandle.KERNEL32(00000000,00DC5489,?,00000000,?,00DCC1D3,?,00DC53BD,00000000,?,00DD784D,?,00DC566D,00DC5479,00DC5479,00000000), ref: 00DE16D2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$ErrorLast$EventObjectSingleWait
                                                        • String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
                                                        • API String ID: 1206859064-226982402
                                                        • Opcode ID: ae4091f4bfcc4ea0fa197b4e92106529ebb16aaf46a15a29727ecc775f056c7f
                                                        • Instruction ID: f342b79db6e1396d635c3229496aa8593b47cf678a081b74bd06fe5e2f87da08
                                                        • Opcode Fuzzy Hash: ae4091f4bfcc4ea0fa197b4e92106529ebb16aaf46a15a29727ecc775f056c7f
                                                        • Instruction Fuzzy Hash: 59212937601A23BBC7216B53CC09B56B6A0FF04721F1D0229E904769A0D775EC90CAF9
                                                        Function 00DD41EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00523: EnterCriticalSection.KERNEL32(00E2B5FC,00000000,?,?,?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?), ref: 00E00533
                                                          • Part of subcall function 00E00523: LeaveCriticalSection.KERNEL32(00E2B5FC,?,?,00E2B5F4,?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?), ref: 00E0067A
                                                        • OpenEventLogW.ADVAPI32(00000000,Application), ref: 00DD4212
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00DD421E
                                                        • ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,00E139D4,00000000), ref: 00DD426B
                                                        • CloseEventLog.ADVAPI32(00000000), ref: 00DD4272
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
                                                        • String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
                                                        • API String ID: 1844635321-1389066741
                                                        • Opcode ID: 2e077d552df4535b6b998aeba156d1db198330b15310e836fed61571122f5fbf
                                                        • Instruction ID: 2381bee947c1d09a20eaf2f5a17b7f30fbb805110f0749e981fc8e4f39f5c5f1
                                                        • Opcode Fuzzy Hash: 2e077d552df4535b6b998aeba156d1db198330b15310e836fed61571122f5fbf
                                                        • Instruction Fuzzy Hash: 0BF0A437A857717B963222731C0EEBB5C6CEFD2F217011119BD50F5281EB548D8180F8
                                                        Function 00DD93FE Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 226COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00DD949E
                                                        • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 00DD94C6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast
                                                        • String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
                                                        • API String ID: 1452528299-4263581490
                                                        • Opcode ID: 88b8c7526c15d45399ef0cf411a28d5733803cf40e0f010e07d3af275a221dc9
                                                        • Instruction ID: ede6bbba6cd0b9988e6c87345786f805e071463b9568ba7b968580cdd8e5f1cf
                                                        • Opcode Fuzzy Hash: 88b8c7526c15d45399ef0cf411a28d5733803cf40e0f010e07d3af275a221dc9
                                                        • Instruction Fuzzy Hash: 20715D72D00229ABDB11DF94C851BEEF7B8AF08720F15412AF915BB391E7369D458BB0
                                                        Function 00DDE56C Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowLongW.USER32(?,000000EB), ref: 00DDE577
                                                        • DefWindowProcW.USER32(?,00000082,?,?), ref: 00DDE5B5
                                                        • SetWindowLongW.USER32(?,000000EB,00000000), ref: 00DDE5C2
                                                        • SetWindowLongW.USER32(?,000000EB,?), ref: 00DDE5D1
                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00DDE5DF
                                                        • CreateCompatibleDC.GDI32(?), ref: 00DDE5EB
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00DDE5FC
                                                        • StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00DDE61E
                                                        • SelectObject.GDI32(00000000,00000000), ref: 00DDE626
                                                        • DeleteDC.GDI32(00000000), ref: 00DDE629
                                                        • PostQuitMessage.USER32(00000000), ref: 00DDE637
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
                                                        • String ID:
                                                        • API String ID: 409979828-0
                                                        • Opcode ID: 8e8c8e1ae40036e6d27a7636b4df901def4fcd3a299fa8d5eadb8bda77eb438d
                                                        • Instruction ID: 68f114a8501285fbda9c5369bf530ca0a5f16f1ebb36548e3478446fec5febbe
                                                        • Opcode Fuzzy Hash: 8e8c8e1ae40036e6d27a7636b4df901def4fcd3a299fa8d5eadb8bda77eb438d
                                                        • Instruction Fuzzy Hash: 12219A32100204BFDB256FB9EC1CD7B3FA8FF49360B194919F616AA2B1D7729850DB60
                                                        Function 00DDA13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Failed to get bundle layout directory property., xrefs: 00DDA287
                                                        • WixBundleLastUsedSource, xrefs: 00DDA1A1
                                                        • WixBundleOriginalSource, xrefs: 00DDA1B7
                                                        • Failed to combine layout source with source., xrefs: 00DDA2A4
                                                        • Failed to combine last source with source., xrefs: 00DDA210
                                                        • WixBundleLayoutDirectory, xrefs: 00DDA26C
                                                        • Failed to get current process directory., xrefs: 00DDA1F3
                                                        • Failed to copy source path., xrefs: 00DDA31A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Find$CloseFileFirstlstrlen
                                                        • String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
                                                        • API String ID: 2767606509-3003062821
                                                        • Opcode ID: 9a70d82f33dd9554e14e70e3cd1efb61a5c47945be04cd7d5b9b27f9139ee7f6
                                                        • Instruction ID: d0ea960d1b5e1c9b9328e9b17deeff6bdae4d0aa4e33cd2a9283f2d3b8d13d0d
                                                        • Opcode Fuzzy Hash: 9a70d82f33dd9554e14e70e3cd1efb61a5c47945be04cd7d5b9b27f9139ee7f6
                                                        • Instruction Fuzzy Hash: E6716E72D05219AFCF15DFA8D841AEEBBB9EF08310F14412AE911B7390D7719D408BB6
                                                        Function 00DCCBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,00DC53BD,00000000,00DC5489,00DC5445,WixBundleUILevel,840F01E8,?,00000001), ref: 00DCCC1C
                                                        Strings
                                                        • Failed to extract file., xrefs: 00DCCCE7
                                                        • Failed to get next stream., xrefs: 00DCCD03
                                                        • Failed to get directory portion of local file path, xrefs: 00DCCCF5
                                                        • Failed to find embedded payload: %ls, xrefs: 00DCCC48
                                                        • payload.cpp, xrefs: 00DCCD1D
                                                        • Failed to concat file paths., xrefs: 00DCCCFC
                                                        • Payload was not found in container: %ls, xrefs: 00DCCD29
                                                        • Failed to ensure directory exists, xrefs: 00DCCCEE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                        • API String ID: 1825529933-1711239286
                                                        • Opcode ID: d56560f77c30c1ffa0f9bc1bb6986cb54d66d4e51f1ce5b88cd509d18c486573
                                                        • Instruction ID: abe3bea557454cf63eb7436c27d6aeb5ea6019aaea1c7dfe4e20d7db1faeec2c
                                                        • Opcode Fuzzy Hash: d56560f77c30c1ffa0f9bc1bb6986cb54d66d4e51f1ce5b88cd509d18c486573
                                                        • Instruction Fuzzy Hash: 1741B231910216ABCF259F44CD81FAEBBB5FF00710B14A16DEA49BB291D7709D80DBB0
                                                        Function 00DC4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00DC47BB
                                                        • GetCurrentThreadId.KERNEL32 ref: 00DC47C1
                                                        • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00DC484F
                                                        Strings
                                                        • Failed to load UX., xrefs: 00DC4804
                                                        • Failed to start bootstrapper application., xrefs: 00DC481D
                                                        • Failed to create user for UX., xrefs: 00DC47DB
                                                        • user.cpp, xrefs: 00DC489B
                                                        • Unexpected return value from message pump., xrefs: 00DC48A5
                                                        • wininet.dll, xrefs: 00DC47EE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Message$CurrentPeekThread
                                                        • String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$user.cpp$wininet.dll
                                                        • API String ID: 673430819-2573580774
                                                        • Opcode ID: f9bb474a6e0edbb72c8f0658fdccffe77892562ec8e89a102abdd273b18df9ca
                                                        • Instruction ID: 0d8bb22e2d9090b571ada84133e0f23d3a0a9daf3cf745c8f392043fb20ce46a
                                                        • Opcode Fuzzy Hash: f9bb474a6e0edbb72c8f0658fdccffe77892562ec8e89a102abdd273b18df9ca
                                                        • Instruction Fuzzy Hash: 16418D71A00656AFEB159BA4CC95FBAB7ACEF04314F20022AF905E7290DB21AD4587B0
                                                        Function 00DE9C84 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 128COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00DEB03E,?,00000001,00000000), ref: 00DE9D0F
                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00DEB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00DE9D19
                                                        • CopyFileExW.KERNEL32(00000000,00000000,00DE9B69,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00DE9D67
                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00DEB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00DE9D96
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$AttributesCopy
                                                        • String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
                                                        • API String ID: 1969131206-836986073
                                                        • Opcode ID: 5e4be15dce2864791cf9e4a3d6ed78bf79c4150ceb26c3c56678eaedd50b2921
                                                        • Instruction ID: 7f6f90dd3dabd3e36bf4c0c8690a404108eadd63576c3aae99f19fed9ecccaef
                                                        • Opcode Fuzzy Hash: 5e4be15dce2864791cf9e4a3d6ed78bf79c4150ceb26c3c56678eaedd50b2921
                                                        • Instruction Fuzzy Hash: A5311972B42666BBDB20BA578C55EABB768FF41B10B184118BD04FB251E621CD40C6F0
                                                        Function 00DD8EBC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00DD9007
                                                        Strings
                                                        • Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00DD8F30
                                                        • Failed to allocate access for Users group to path: %ls, xrefs: 00DD8F72
                                                        • Failed to create ACL to secure cache path: %ls, xrefs: 00DD8FBB
                                                        • Failed to allocate access for Administrators group to path: %ls, xrefs: 00DD8F0F
                                                        • Failed to allocate access for Everyone group to path: %ls, xrefs: 00DD8F51
                                                        • cache.cpp, xrefs: 00DD8FB0
                                                        • Failed to secure cache path: %ls, xrefs: 00DD8FEA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeLocal
                                                        • String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
                                                        • API String ID: 2826327444-4113288589
                                                        • Opcode ID: cdd02e18b83d6a2784f160dabd38a30ee955b3dbef91b9e2e9fc5fd6efa39bfd
                                                        • Instruction ID: 39c23c1583160c103907fb6251d65a0b6b972e32a02eeb2d86d94e9aae83fa46
                                                        • Opcode Fuzzy Hash: cdd02e18b83d6a2784f160dabd38a30ee955b3dbef91b9e2e9fc5fd6efa39bfd
                                                        • Instruction Fuzzy Hash: A141C632E44329BBDB3257648C06FAA7679EF40B10F1140A6FA44BB281DF719E44A7F0
                                                        Function 00DD492F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ReadFile.KERNEL32(00000000,crypt32.dll,00000008,?,00000000,?,00000000,00000000,crypt32.dll,00000000,?,?,?,00000000,?,00000000), ref: 00DD495A
                                                        • GetLastError.KERNEL32 ref: 00DD4967
                                                        • ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 00DD4A12
                                                        • GetLastError.KERNEL32 ref: 00DD4A1C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastRead
                                                        • String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$crypt32.dll$pipe.cpp
                                                        • API String ID: 1948546556-773887359
                                                        • Opcode ID: 4ee2a0d3469b968691a8b2008a740e2422466a8cb68220c39653bb05769fa926
                                                        • Instruction ID: ae49bf4951a30bcd82289a1e99e751187b9f0ed924a87d7f178e796486306c17
                                                        • Opcode Fuzzy Hash: 4ee2a0d3469b968691a8b2008a740e2422466a8cb68220c39653bb05769fa926
                                                        • Instruction Fuzzy Hash: 7131D972D8022ABBDB119BA68C45BAFB668FF04725F11912AFC40B7380D7709D408BF4
                                                        Function 00E06C29 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 114COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7622DFD0), ref: 00E06C88
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00E06CA5
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06CE3
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06D27
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$CompareFree
                                                        • String ID: `Dv$email$name$uri
                                                        • API String ID: 3589242889-3963012511
                                                        • Opcode ID: a775bdc71d7e59cbeeabb2739284a3d8db52ef5565a0854983a54d6da9388b35
                                                        • Instruction ID: 33b3b6e7be1f500b67e361686fdd9cd8945ea45a3d6b6e7db638461d728a4510
                                                        • Opcode Fuzzy Hash: a775bdc71d7e59cbeeabb2739284a3d8db52ef5565a0854983a54d6da9388b35
                                                        • Instruction Fuzzy Hash: 9941AF31A01219BBDB159B90CD85FADB778EF04725F2452A4E960BB1E0C7719E90DB50
                                                        Function 00DDE2AF Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadBitmapW.USER32(?,00000001), ref: 00DDE2E5
                                                        • GetLastError.KERNEL32 ref: 00DDE2F1
                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 00DDE338
                                                        • GetCursorPos.USER32(?), ref: 00DDE359
                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00DDE36B
                                                        • GetMonitorInfoW.USER32(00000000,?), ref: 00DDE381
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
                                                        • String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
                                                        • API String ID: 2342928100-598475503
                                                        • Opcode ID: e834aebe8474411efddef4f454a02336a67459ac37bc3858f4f5a5edf03b4f75
                                                        • Instruction ID: d2dc43c362e85748f22dc79c640f01b4edbf900cbd9b9e74f5cafd075647f19f
                                                        • Opcode Fuzzy Hash: e834aebe8474411efddef4f454a02336a67459ac37bc3858f4f5a5edf03b4f75
                                                        • Instruction Fuzzy Hash: 58314F71A00219AFDB14DFA9D949A9EBBF4FF08711F148119E904FB281DB71E9448BA0
                                                        Function 00DD50CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcessId.KERNEL32(?,00000000,?,?,00E0B500), ref: 00DD50D3
                                                        • GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00DD5171
                                                        • CloseHandle.KERNEL32(00000000), ref: 00DD518A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Process$CloseCurrentHandle
                                                        • String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
                                                        • API String ID: 2815245435-1352204306
                                                        • Opcode ID: 36adc57eea4094b1dc868f3cdc4a857d32558c9fd6b14de88eb9328ac63f28e6
                                                        • Instruction ID: 3895211da01481af4e342f1eaf22ac586857228efd7c7ff0785e0dbff3b2d2f9
                                                        • Opcode Fuzzy Hash: 36adc57eea4094b1dc868f3cdc4a857d32558c9fd6b14de88eb9328ac63f28e6
                                                        • Instruction Fuzzy Hash: CA2148B5900619FFCF119F94EC81AAEBBB8FF04350B50816AF824B2351D7319E909BA0
                                                        Function 00DC6882 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 75libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00DC68AC
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00DC68B3
                                                        • GetLastError.KERNEL32 ref: 00DC68BD
                                                        Strings
                                                        • Failed to find DllGetVersion entry point in msi.dll., xrefs: 00DC68EB
                                                        • DllGetVersion, xrefs: 00DC689E
                                                        • Failed to set variant value., xrefs: 00DC6929
                                                        • variable.cpp, xrefs: 00DC68E1
                                                        • Failed to get msi.dll version info., xrefs: 00DC6905
                                                        • msi, xrefs: 00DC68A3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorHandleLastModuleProc
                                                        • String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
                                                        • API String ID: 4275029093-842451892
                                                        • Opcode ID: 0255766dfc230d135e6c383a6d595bf0fc02e944acf733f1b1e74dd4d2d69782
                                                        • Instruction ID: 9f84d15e44b93fe1bbc603a88cd69f795c7e25adc8c5d6cc63c0a379408cc599
                                                        • Opcode Fuzzy Hash: 0255766dfc230d135e6c383a6d595bf0fc02e944acf733f1b1e74dd4d2d69782
                                                        • Instruction Fuzzy Hash: 0911B476A4473ABAD7216BA9CC42FAFBBA4AB08B10F110529FD01F71C1DA75DC4486F1
                                                        Function 00DCD6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00DC47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DC548E,?), ref: 00DCD6DA
                                                        • GetLastError.KERNEL32(?,00DC47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DC548E,?,?), ref: 00DCD6E7
                                                        • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00DCD71F
                                                        • GetLastError.KERNEL32(?,00DC47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00DC548E,?,?), ref: 00DCD72B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$AddressLibraryLoadProc
                                                        • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                        • API String ID: 1866314245-2276003667
                                                        • Opcode ID: 6da4aec37ffd930f7398ab88ce3d88ef0cfa9e679a62ed0fc61e1079a2d48c43
                                                        • Instruction ID: aa57b0f5b39a323c56aaafa66793d810613d8d960f351d567ed016ef581f2e7a
                                                        • Opcode Fuzzy Hash: 6da4aec37ffd930f7398ab88ce3d88ef0cfa9e679a62ed0fc61e1079a2d48c43
                                                        • Instruction Fuzzy Hash: 8D119037A80B33ABC73256955C05F1B7A94AF04B61F064539FE55BB6C0EB61DC508AE0
                                                        Function 00DC1175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC1186
                                                        • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC1191
                                                        • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DC119F
                                                        • GetLastError.KERNEL32(?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC11BA
                                                        • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DC11C2
                                                        • GetLastError.KERNEL32(?,?,?,?,?,00DC111A,cabinet.dll,00000009,?,?,00000000), ref: 00DC11D7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorLastProc$HandleHeapInformationModule
                                                        • String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
                                                        • API String ID: 3104334766-1824683568
                                                        • Opcode ID: 4df5f394a15fc710d3172b409fd5dbc5c6f8771067f064d40e31be42de811f2e
                                                        • Instruction ID: 9e072f5613fb12163152f251d50babc018f5caf5aef9000a2503bdb4ce541776
                                                        • Opcode Fuzzy Hash: 4df5f394a15fc710d3172b409fd5dbc5c6f8771067f064d40e31be42de811f2e
                                                        • Instruction Fuzzy Hash: 70019E3560032BBAD6106BA79C49E6B7B5CFF42760B088019FA15B3141EB719A858AB0
                                                        Function 00DDF639 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DDF64E
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DDF7C9
                                                        Strings
                                                        • Failed to set download password., xrefs: 00DDF777
                                                        • UX did not provide container or payload id., xrefs: 00DDF7B8
                                                        • UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00DDF6B9
                                                        • Failed to set download user., xrefs: 00DDF751
                                                        • UX requested unknown payload with id: %ls, xrefs: 00DDF6A3
                                                        • UX requested unknown container with id: %ls, xrefs: 00DDF6F3
                                                        • user is active, cannot change user state., xrefs: 00DDF668
                                                        • Failed to set download URL., xrefs: 00DDF728
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: user is active, cannot change user state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                        • API String ID: 3168844106-2615595102
                                                        • Opcode ID: 252cf12e8711d95d71497e16610fbf6b541ffd673f7d7d8a3860ff036c538128
                                                        • Instruction ID: 55d02b02d3131964ba5cd8d133e7a6aada06c1d153aec55197ef2da494aed642
                                                        • Opcode Fuzzy Hash: 252cf12e8711d95d71497e16610fbf6b541ffd673f7d7d8a3860ff036c538128
                                                        • Instruction Fuzzy Hash: 9341A572501612BBCB219F64CC45FAAB3A8EF04710B194177F816AB391EB75ED90C7B1
                                                        Function 00E05A5E Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196filememoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00E05A9B
                                                        • GetLastError.KERNEL32 ref: 00E05AA9
                                                        • VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00E05AEA
                                                        • GetLastError.KERNEL32 ref: 00E05AF7
                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00E05C6A
                                                        • CloseHandle.KERNEL32(?), ref: 00E05C79
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
                                                        • String ID: GET$dlutil.cpp
                                                        • API String ID: 2028584396-3303425918
                                                        • Opcode ID: 0207e605a2cf783a0f5a08d1e3b1b90b37fbb40e6a7b3f0fc2f4fdd27d7aeb06
                                                        • Instruction ID: e97dc2c66183b9cc079523b8e1b55938d9a3fa42d0bb11afa193ca9e54a40bab
                                                        • Opcode Fuzzy Hash: 0207e605a2cf783a0f5a08d1e3b1b90b37fbb40e6a7b3f0fc2f4fdd27d7aeb06
                                                        • Instruction Fuzzy Hash: 57613C72A00619ABDB21CFA5CD85BEFBBB8FF48754F151119FD15B6280E77099808F90
                                                        Function 00DD0C50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DD1020: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00DD0C6F,?,00000000,?,00000000,00000000), ref: 00DD104F
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00DD0DF3
                                                        • GetLastError.KERNEL32 ref: 00DD0E00
                                                        Strings
                                                        • Failed to append rollback cache action., xrefs: 00DD0CCF
                                                        • Failed to append payload cache action., xrefs: 00DD0DAA
                                                        • Failed to create syncpoint event., xrefs: 00DD0E2E
                                                        • plan.cpp, xrefs: 00DD0E24
                                                        • Failed to append package start action., xrefs: 00DD0C95
                                                        • Failed to append cache action., xrefs: 00DD0D4A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareCreateErrorEventLastString
                                                        • String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
                                                        • API String ID: 801187047-2489563283
                                                        • Opcode ID: 3daae5700d34b3691deedfe7e0e499bf006e9696c5ee5debf3b25e9417a5fe82
                                                        • Instruction ID: 4f2b358ef39ab216d19c3213a994e2bd540172c109eacd903b8445eb5f667be6
                                                        • Opcode Fuzzy Hash: 3daae5700d34b3691deedfe7e0e499bf006e9696c5ee5debf3b25e9417a5fe82
                                                        • Instruction Fuzzy Hash: AD6170B5500605EFCB15DF69C980AAABBFAFF84310F25845BE9059B311EB31EE41DB60
                                                        Function 00E06EFF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,7622DFD0,000000FF,type,000000FF,?,7622DFD0,7622DFD0,7622DFD0), ref: 00E06F55
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06FA0
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E0701C
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07068
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$Free$Compare
                                                        • String ID: `Dv$type$url
                                                        • API String ID: 1324494773-3411263640
                                                        • Opcode ID: bc5582783af1eec75bf9b0b79c6346d2d19d5661375ff25b73b70a7222132ff4
                                                        • Instruction ID: cb135fc52aace460bee051eef7e1870dde5dfcaf01509f43f7a400e779c7f545
                                                        • Opcode Fuzzy Hash: bc5582783af1eec75bf9b0b79c6346d2d19d5661375ff25b73b70a7222132ff4
                                                        • Instruction Fuzzy Hash: 5A518C35D05219EFCB25DFA4C844FAEBBB8AF04714F205299E451FB1A0D731AE80DB50
                                                        Function 00DD05A2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 133registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00E0B500,00000000,?), ref: 00DD06D3
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00E0B500,00000000,?), ref: 00DD06E2
                                                          • Part of subcall function 00E00BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00DD061A,?,00000000,00020006), ref: 00E00C0E
                                                        Strings
                                                        • %ls.RebootRequired, xrefs: 00DD05F0
                                                        • Failed to open registration key., xrefs: 00DD071A
                                                        • Failed to write volatile reboot required registry key., xrefs: 00DD061E
                                                        • Failed to delete registration key: %ls, xrefs: 00DD0681
                                                        • Failed to update resume mode., xrefs: 00DD06B7
                                                        • crypt32.dll, xrefs: 00DD05AC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close$Create
                                                        • String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.$crypt32.dll
                                                        • API String ID: 359002179-3398658923
                                                        • Opcode ID: 71d8cd4a3b61ac80d78be6eb6afd22fd12fc32258c9a179412213b6fb023c3fe
                                                        • Instruction ID: 88865ee89c6a9c1378699a93a3210c13a7c9161b266eb80cf391a2176682e27c
                                                        • Opcode Fuzzy Hash: 71d8cd4a3b61ac80d78be6eb6afd22fd12fc32258c9a179412213b6fb023c3fe
                                                        • Instruction Fuzzy Hash: 61416C31900319BBDB22AEA0DC06FAE7BBAEFC0310F14445AF51562261D7719AA09A75
                                                        Function 00E0159E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 117stringregistryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 00E015DA
                                                        • lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00E0163C
                                                        • lstrlenW.KERNEL32(?), ref: 00E01648
                                                        • RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00E0168B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen$Value
                                                        • String ID: @f$@f$BundleUpgradeCode$regutil.cpp
                                                        • API String ID: 198323757-2531891329
                                                        • Opcode ID: 2429dac63f37d5b6a9ce105b0b30dcc689c6d02a382a6cf4ad64d9b307df1c44
                                                        • Instruction ID: 7d9ff90088637527fa5e13632982e4ff0ae4f24cfc87ce8500989c2b5a505b24
                                                        • Opcode Fuzzy Hash: 2429dac63f37d5b6a9ce105b0b30dcc689c6d02a382a6cf4ad64d9b307df1c44
                                                        • Instruction Fuzzy Hash: 69417172D0022AAFCB219F949D81AAEBBB8FF44754F0511A9FD11BF250C771DD518BA0
                                                        Function 00DCF451 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCF48A
                                                          • Part of subcall function 00DC4115: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?), ref: 00DC4123
                                                          • Part of subcall function 00DC4115: GetLastError.KERNEL32(?,00DDA0E8,00000000,00000000,?,00000000,00DC53BD,00000000,?,?,00DCD5B5,?,00000000,00000000), ref: 00DC4131
                                                        • lstrlenA.KERNEL32(00E0B500,00000000,00000094,00000000,00000094,?,?,00DD04BF,swidtag,00000094,?,00E0B518,00DD04BF,00000000,?,00000000), ref: 00DCF4DD
                                                          • Part of subcall function 00E04DB3: CreateFileW.KERNEL32(00E0B500,40000000,00000001,00000000,00000002,00000080,00000000,00DD04BF,00000000,?,00DCF4F4,?,00000080,00E0B500,00000000), ref: 00E04DCB
                                                          • Part of subcall function 00E04DB3: GetLastError.KERNEL32(?,00DCF4F4,?,00000080,00E0B500,00000000,?,00DD04BF,?,00000094,?,?,?,?,?,00000000), ref: 00E04DD8
                                                        Strings
                                                        • Failed to format tag folder path., xrefs: 00DCF543
                                                        • Failed to allocate regid folder path., xrefs: 00DCF53C
                                                        • swidtag, xrefs: 00DCF49D
                                                        • Failed to write tag xml to file: %ls, xrefs: 00DCF51B
                                                        • Failed to allocate regid file path., xrefs: 00DCF535
                                                        • Failed to create regid folder: %ls, xrefs: 00DCF525
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
                                                        • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
                                                        • API String ID: 904508749-1201533908
                                                        • Opcode ID: fd06bd6cfa9e0f853a5ab9466e0eb5825ccc4051e547c632232088b8cac8871d
                                                        • Instruction ID: 237a73f69fc04dd2529150e0328bbe30fb944ab210da8e649c4128d4dda7ecb8
                                                        • Opcode Fuzzy Hash: fd06bd6cfa9e0f853a5ab9466e0eb5825ccc4051e547c632232088b8cac8871d
                                                        • Instruction Fuzzy Hash: 2F313C72D0021ABBCB119F94DC41FEDBBB6EF04710F1481AAEA10B7261D7719A909FA0
                                                        Function 00DD53E2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00DC548E,00000000,00000000,?,00000000), ref: 00DD548B
                                                        • GetLastError.KERNEL32(?,?,?,00DC4C61,?,?,00000000,?,?,?,?,?,?,00E0B4A0,?,?), ref: 00DD5496
                                                        Strings
                                                        • Failed to write restart to message buffer., xrefs: 00DD542E
                                                        • Failed to post terminate message to child process., xrefs: 00DD5476
                                                        • Failed to write exit code to message buffer., xrefs: 00DD5406
                                                        • pipe.cpp, xrefs: 00DD54BA
                                                        • Failed to wait for child process exit., xrefs: 00DD54C4
                                                        • Failed to post terminate message to child process cache thread., xrefs: 00DD545A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastObjectSingleWait
                                                        • String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
                                                        • API String ID: 1211598281-2161881128
                                                        • Opcode ID: d08358bb13ffb256b7f2623707220ace6b515fa40cff060db1706287ce3e3a10
                                                        • Instruction ID: 64d6184519e9a49bf599f7bb934d29cdfc1721bf563dbbe80ad1585cf769f118
                                                        • Opcode Fuzzy Hash: d08358bb13ffb256b7f2623707220ace6b515fa40cff060db1706287ce3e3a10
                                                        • Instruction Fuzzy Hash: 1D21D272940A2ABBCF225B90EC05EEE7769EF00766F104213F900B6394D731AE9096F1
                                                        Function 00DD9098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00DD9F04,00000003,000007D0,00000003,?,000007D0), ref: 00DD90B2
                                                        • GetLastError.KERNEL32(?,00DD9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 00DD90BF
                                                        • CloseHandle.KERNEL32(00000000,?,00DD9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 00DD9187
                                                        Strings
                                                        • Failed to open payload at path: %ls, xrefs: 00DD9103
                                                        • Failed to verify signature of payload: %ls, xrefs: 00DD912F
                                                        • Failed to verify catalog signature of payload: %ls, xrefs: 00DD914E
                                                        • cache.cpp, xrefs: 00DD90F6
                                                        • Failed to verify hash of payload: %ls, xrefs: 00DD9172
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorFileHandleLast
                                                        • String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
                                                        • API String ID: 2528220319-2757871984
                                                        • Opcode ID: 949474c14c7194114aa6ac4ccfcf4944ea13097f8b056d604dabc594e6b2aca4
                                                        • Instruction ID: 6ee2e68e76321929b38b1c49ac69ad81f4ea4b43d79e64a053ecfe1a7f1b53d4
                                                        • Opcode Fuzzy Hash: 949474c14c7194114aa6ac4ccfcf4944ea13097f8b056d604dabc594e6b2aca4
                                                        • Instruction Fuzzy Hash: 8C21A336540727BBCB221A648C59F9ABA28BF00760F154313FD54763A093739CA1EAF1
                                                        Function 00DC6B1E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00DC6B69
                                                        • GetLastError.KERNEL32 ref: 00DC6B73
                                                        • GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00DC6BB7
                                                        • GetLastError.KERNEL32 ref: 00DC6BC1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$DirectoryNamePathVolumeWindows
                                                        • String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 124030351-4026719079
                                                        • Opcode ID: 8ddf500ea953b641bc651cdec20e2db3a3c11aeb1a3668543bab9bacd09a86d6
                                                        • Instruction ID: 13b8de971721f56bfb4d4697394561e326fbade49e4d9c4feccc7bb7a5440701
                                                        • Opcode Fuzzy Hash: 8ddf500ea953b641bc651cdec20e2db3a3c11aeb1a3668543bab9bacd09a86d6
                                                        • Instruction Fuzzy Hash: EC21F773E4123A6BD720A7958D46F9F77ACEB40B10F114169BD04F7281EA34EE808AF5
                                                        Function 00DC9C6D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9C88
                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,000002C0,?,00DCA895,00000100,000002C0,000002C0,?,000002C0), ref: 00DC9CA0
                                                        • GetLastError.KERNEL32(?,00DCA895,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00DC9CAB
                                                        Strings
                                                        • Failed to format variable string., xrefs: 00DC9C93
                                                        • Failed to set variable., xrefs: 00DC9D2B
                                                        • search.cpp, xrefs: 00DC9CDB
                                                        • Failed get to file attributes. '%ls', xrefs: 00DC9CE8
                                                        • File search: %ls, did not find path: %ls, xrefs: 00DC9CFD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileLastOpen@16
                                                        • String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
                                                        • API String ID: 1811509786-2053429945
                                                        • Opcode ID: e53c7b50b9301ece45bd4094a425b725fec6ea1dc6b2bb1cd13513bfc17d92de
                                                        • Instruction ID: 040aaf06d0d832fed640b84d248c66e3241f9c8c017e7fd3d4c137248f77b633
                                                        • Opcode Fuzzy Hash: e53c7b50b9301ece45bd4094a425b725fec6ea1dc6b2bb1cd13513bfc17d92de
                                                        • Instruction Fuzzy Hash: B1216533940226BAEB212A948D8AFAEF668EF10721F240229FD05771E0D7219D8096F1
                                                        Function 00DDAD40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • TlsSetValue.KERNEL32(?,?), ref: 00DDAD57
                                                        • GetLastError.KERNEL32 ref: 00DDAD61
                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 00DDADA0
                                                        • CoUninitialize.OLE32(?,00DDC721,?,?), ref: 00DDADDD
                                                        Strings
                                                        • Failed to initialize COM., xrefs: 00DDADAC
                                                        • Failed to pump messages in child process., xrefs: 00DDADCB
                                                        • elevation.cpp, xrefs: 00DDAD85
                                                        • Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00DDAD8F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorInitializeLastUninitializeValue
                                                        • String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
                                                        • API String ID: 876858697-113251691
                                                        • Opcode ID: 27cb403e7981a503ea91de328ae9a239f2098097c76c31cd4fc6f0814eebf3c4
                                                        • Instruction ID: cea842f37c456f75d9478dd9c162c6271a5e98863f43a42135532042d4e14570
                                                        • Opcode Fuzzy Hash: 27cb403e7981a503ea91de328ae9a239f2098097c76c31cd4fc6f0814eebf3c4
                                                        • Instruction Fuzzy Hash: CD112372941631BFC62117899C05D9EBA68EF04B62B118117FC00B7750EB71AD4082F1
                                                        Function 00DC5CE2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00DC5D68
                                                          • Part of subcall function 00E010B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00E0112B
                                                          • Part of subcall function 00E010B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00E01163
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$Close
                                                        • String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
                                                        • API String ID: 1979452859-3209209246
                                                        • Opcode ID: 974bf1ec36f0f342115072b1480d20e03781e4264cae7f2d9b89d9d6e4f0a5dc
                                                        • Instruction ID: af766db48fcd908e856ab2f6037de134762340bf0102effb233f0e0263719633
                                                        • Opcode Fuzzy Hash: 974bf1ec36f0f342115072b1480d20e03781e4264cae7f2d9b89d9d6e4f0a5dc
                                                        • Instruction Fuzzy Hash: 8C01F572A4872AB7CB2256D4AC0AFAE7768DB50720F144259F8017B2A5C7719EC097A1
                                                        Function 00DEA271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00DEA33E
                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 00DEA348
                                                        Strings
                                                        • Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00DEA425
                                                        • Failed to clear readonly bit on payload destination path: %ls, xrefs: 00DEA377
                                                        • apply.cpp, xrefs: 00DEA36C
                                                        • :, xrefs: 00DEA3C1
                                                        • download, xrefs: 00DEA308
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileLast
                                                        • String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
                                                        • API String ID: 1799206407-1905830404
                                                        • Opcode ID: edef907d11632621b57515c2a5822f6f66c1dcaf26dc6bb16cff3724517c210e
                                                        • Instruction ID: 2312e5ea52eff58532485689fe8182bac27282587f8e9cec5ab31c4dcfeebde2
                                                        • Opcode Fuzzy Hash: edef907d11632621b57515c2a5822f6f66c1dcaf26dc6bb16cff3724517c210e
                                                        • Instruction Fuzzy Hash: 25518F71A0021AAFDB11EFDAC841AAEB7B5FF14710F148159E904FB250E371EE40CBA1
                                                        Function 00E084C7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00DE9063,000002C0,00000100), ref: 00E084F5
                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00DE9063,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00E08510
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareHeapString$AllocateProcess
                                                        • String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
                                                        • API String ID: 2664528157-4206478990
                                                        • Opcode ID: 88de292fa7c3f229db80ace99ea77d721bcb3ccb38268aaaa568492d95216a4e
                                                        • Instruction ID: ebb3ecda9e0349f7055885cbc22ae38940beb36212f2ef81c4e2f7002c1bde97
                                                        • Opcode Fuzzy Hash: 88de292fa7c3f229db80ace99ea77d721bcb3ccb38268aaaa568492d95216a4e
                                                        • Instruction Fuzzy Hash: 7551C471644302AFDB209F14DE81F5A7BA5EF00724F219618F9A5FB2D1DB71ED808B50
                                                        Function 00E064B7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32 ref: 00E06513
                                                        • DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00E0660A
                                                        • CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00E06619
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseDeleteErrorFileHandleLast
                                                        • String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
                                                        • API String ID: 3522763407-1704223933
                                                        • Opcode ID: b7fb91247fb8c1f901d2bda19a298690aaa6317e806837937e99251669295029
                                                        • Instruction ID: 0c7e5688ceedf540b1d984303394dff7156c739d684d4fb290560338b614ec52
                                                        • Opcode Fuzzy Hash: b7fb91247fb8c1f901d2bda19a298690aaa6317e806837937e99251669295029
                                                        • Instruction Fuzzy Hash: F2511972D00229BFDF12DFA4DC45EAFBBB9EB08710F045165FA14F6190E7318A919BA0
                                                        Function 00DC9EC7 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9EED
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9F12
                                                        Strings
                                                        • MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00DCA006
                                                        • Failed to get component path: %d, xrefs: 00DC9F76
                                                        • Failed to set variable., xrefs: 00DC9FF6
                                                        • Failed to format component id string., xrefs: 00DC9EF8
                                                        • Failed to format product code string., xrefs: 00DC9F1D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16
                                                        • String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
                                                        • API String ID: 3613110473-1671347822
                                                        • Opcode ID: 2c5e7a4926a93209f90cb1f292edd6c6a45cb1f0975fabdf91ece809f6aa616d
                                                        • Instruction ID: 4e44665941f239c19198ae8b15ef4e1fecb8f0df1378ef67550bb02484e3bde0
                                                        • Opcode Fuzzy Hash: 2c5e7a4926a93209f90cb1f292edd6c6a45cb1f0975fabdf91ece809f6aa616d
                                                        • Instruction Fuzzy Hash: BC419332904116BACB259AA88C5AFBEF7A8EF05310F28461EF514F3191D7319A9097B5
                                                        Function 00DCF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00DCF942
                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00DCF94F
                                                        Strings
                                                        • Resume, xrefs: 00DCF8B6
                                                        • %ls.RebootRequired, xrefs: 00DCF82F
                                                        • Failed to format pending restart registry key to read., xrefs: 00DCF846
                                                        • Failed to open registration key., xrefs: 00DCF8AB
                                                        • Failed to read Resume value., xrefs: 00DCF8D8
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close
                                                        • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                        • API String ID: 3535843008-3890505273
                                                        • Opcode ID: f54cc1107719c5e6820e0598f16c72c5190ec3d50acb96ef81940a685a3ffd4d
                                                        • Instruction ID: 2935f6711faee566d38555f0775abc1aa8ae6a403ff4cc72ea57d3b4345629e6
                                                        • Opcode Fuzzy Hash: f54cc1107719c5e6820e0598f16c72c5190ec3d50acb96ef81940a685a3ffd4d
                                                        • Instruction Fuzzy Hash: AD413A7190021AFBCF129F98C881BEDBBA6EF04310F15416AE950AB250C7729E819FA1
                                                        Function 00DDAA00 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
                                                        • API String ID: 0-660234312
                                                        • Opcode ID: c850c00edc9b96fa22f2391cef2d1ab47e9a085c81d3636c60bf571fd9b1d0c6
                                                        • Instruction ID: c7b137f7772e02ae42d9b78e63382d115bf29d97ebcaf4b6180222ceac007624
                                                        • Opcode Fuzzy Hash: c850c00edc9b96fa22f2391cef2d1ab47e9a085c81d3636c60bf571fd9b1d0c6
                                                        • Instruction Fuzzy Hash: 7031A532904229BFCB229A98CD45F9EBBB9EB00720F119356F810B73D1DB719D41D6A1
                                                        Function 00DED8B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoCreateInstance.OLE32(00E20C4C,00000000,00000017,00E20C5C,?,?,00000000,00000000,?,?,?,?,?,00DEDEE7,00000000,00000000), ref: 00DED8E8
                                                        Strings
                                                        • WixBurn, xrefs: 00DED913
                                                        • Failed to set notification flags for BITS job., xrefs: 00DED93A
                                                        • Failed to create IBackgroundCopyManager., xrefs: 00DED8F4
                                                        • Failed to set BITS job to foreground., xrefs: 00DED969
                                                        • Failed to set progress timeout., xrefs: 00DED952
                                                        • Failed to create BITS job., xrefs: 00DED922
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateInstance
                                                        • String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
                                                        • API String ID: 542301482-468763447
                                                        • Opcode ID: a0df0616fe0841e354384c431be6cf50b329125e6f31e173f4cdaa447190ca6a
                                                        • Instruction ID: 8c8ae5e0b0199516fad17bdfe446d3bdc1b0488f91f714fd889087c860ef19a6
                                                        • Opcode Fuzzy Hash: a0df0616fe0841e354384c431be6cf50b329125e6f31e173f4cdaa447190ca6a
                                                        • Instruction Fuzzy Hash: C7317271A40359AFD714EBAADC86E6FBBB5AF48710B100169E905FB391CA30DC05CBA1
                                                        Function 00E05DAE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00E05DF8
                                                        • GetLastError.KERNEL32 ref: 00E05E05
                                                        • ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00E05E4C
                                                        • GetLastError.KERNEL32 ref: 00E05E80
                                                        • CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 00E05EB4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$CloseCreateHandleRead
                                                        • String ID: %ls.R$dlutil.cpp
                                                        • API String ID: 3160720760-657863730
                                                        • Opcode ID: bbf4501450e172f7e9246f249420b74783df89b32306fa455b3ab3bc65446109
                                                        • Instruction ID: f0c576c19bd849e53f5e26e420da1e3c8860e08f4d1b5e5d22c8dbb6375d5777
                                                        • Opcode Fuzzy Hash: bbf4501450e172f7e9246f249420b74783df89b32306fa455b3ab3bc65446109
                                                        • Instruction Fuzzy Hash: 98310273941625EBEB208B64CC45BAF7AA8FF00721F114219FE40FB2C0D7709E818AE0
                                                        Function 00DCC8E6 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DCCD5E: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,00DCE444,000000FF,00000000,00000000,00DCE444,?,?,00DCDBEB,?,?,?,?), ref: 00DCCD89
                                                        • CreateFileW.KERNEL32(E900E0BA,80000000,00000005,00000000,00000003,08000000,00000000,00DC53C5,?,00000000,840F01E8,14680A79,00000001,00DC53BD,00000000,00DC5489), ref: 00DCC956
                                                        • GetLastError.KERNEL32(?,?,?,00DD7809,00DC566D,00DC5479,00DC5479,00000000,?,00DC5489,FFF9E89D,00DC5489,00DC54BD,00DC5445,?,00DC5445), ref: 00DCC99B
                                                        Strings
                                                        • Failed to find payload for catalog file., xrefs: 00DCC9E0
                                                        • Failed to verify catalog signature: %ls, xrefs: 00DCC994
                                                        • Failed to open catalog in working path: %ls, xrefs: 00DCC9C9
                                                        • catalog.cpp, xrefs: 00DCC9BC
                                                        • Failed to get catalog local file path, xrefs: 00DCC9D9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareCreateErrorFileLastString
                                                        • String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
                                                        • API String ID: 1774366664-48089280
                                                        • Opcode ID: 8a3ab995ce4aa1488a7ddbc5f757d88a1f85ef4b7a35bcf0634bdc10008d2522
                                                        • Instruction ID: a7581c9aceec740588e0aa557722c5771becece2e679aac9c3b4e47197c0623a
                                                        • Opcode Fuzzy Hash: 8a3ab995ce4aa1488a7ddbc5f757d88a1f85ef4b7a35bcf0634bdc10008d2522
                                                        • Instruction Fuzzy Hash: 2731C972950626BFC7219B54CC42F59BBA4EF04711F11516EFA08FB290EB71ED509BE0
                                                        Function 00DED33E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000000FF,762330B0,00000000,?,?,?,?,00DED642,?), ref: 00DED357
                                                        • ReleaseMutex.KERNEL32(?,?,?,?,00DED642,?), ref: 00DED375
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DED3B6
                                                        • ReleaseMutex.KERNEL32(?), ref: 00DED3CD
                                                        • SetEvent.KERNEL32(?), ref: 00DED3D6
                                                        Strings
                                                        • Failed to send files in use message from netfx chainer., xrefs: 00DED41C
                                                        • Failed to get message from netfx chainer., xrefs: 00DED3F7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: MutexObjectReleaseSingleWait$Event
                                                        • String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
                                                        • API String ID: 2608678126-3424578679
                                                        • Opcode ID: d7ba9e95286460bcfbf88342e9fd64c3aa78cdb102f335902457cca6e62b7674
                                                        • Instruction ID: 3a7eb43716fa39eaf81502c449f4efdb377fca0837dbd2ccd8a71e3a9243c765
                                                        • Opcode Fuzzy Hash: d7ba9e95286460bcfbf88342e9fd64c3aa78cdb102f335902457cca6e62b7674
                                                        • Instruction Fuzzy Hash: E3310731900659BFCB129F95DC08EAEBBF5EF54320F108265F965F22A1CB31D9548BA0
                                                        Function 00E0093B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92processCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00E009AB
                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00E009B5
                                                        • CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 00E009FE
                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00E00A0B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$CreateErrorLastProcess
                                                        • String ID: "%ls" %ls$D$procutil.cpp
                                                        • API String ID: 161867955-2732225242
                                                        • Opcode ID: 0bdfc0fbdf42e0e2757f599dd1379d1a292dcdd4afe4aa38f534bb85d0e5bd8d
                                                        • Instruction ID: 6d1fd718a9f45150e5b05362bb3d141ebcb02b996102b4d03eed27303f90654f
                                                        • Opcode Fuzzy Hash: 0bdfc0fbdf42e0e2757f599dd1379d1a292dcdd4afe4aa38f534bb85d0e5bd8d
                                                        • Instruction Fuzzy Hash: 26216D72D0121EABDB11DFE5CD41AAFBBB8FF44714F10142AEA00B7291D3719E808AA1
                                                        Function 00DC9B9A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9BB3
                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00DCA8AB,00000100,000002C0,000002C0,00000100), ref: 00DC9BD3
                                                        • GetLastError.KERNEL32(?,00DCA8AB,00000100,000002C0,000002C0,00000100), ref: 00DC9BDE
                                                        Strings
                                                        • Failed while searching directory search: %ls, for path: %ls, xrefs: 00DC9C34
                                                        • Failed to format variable string., xrefs: 00DC9BBE
                                                        • Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00DC9C4A
                                                        • Failed to set directory search path variable., xrefs: 00DC9C0F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileLastOpen@16
                                                        • String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
                                                        • API String ID: 1811509786-2966038646
                                                        • Opcode ID: 8b6a9f68acaf4e8c09e11d747ebdff17036891aafa29441b4b0175c9a8f0f285
                                                        • Instruction ID: 811bb655dbeab7d41ee6303b71ea2da40b8b1e7b69005ddc3add733529092f84
                                                        • Opcode Fuzzy Hash: 8b6a9f68acaf4e8c09e11d747ebdff17036891aafa29441b4b0175c9a8f0f285
                                                        • Instruction Fuzzy Hash: 22210B33940127FBCB2226949E1AF5DFBA9EF10320F240219FD10771A1D7769E90A6F9
                                                        Function 00DC9D4B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9D64
                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00DCA883,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00DC9D84
                                                        • GetLastError.KERNEL32(?,00DCA883,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00DC9D8F
                                                        Strings
                                                        • Failed to format variable string., xrefs: 00DC9D6F
                                                        • Failed while searching file search: %ls, for path: %ls, xrefs: 00DC9DBD
                                                        • Failed to set variable to file search path., xrefs: 00DC9DE7
                                                        • File search: %ls, did not find path: %ls, xrefs: 00DC9DF3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileLastOpen@16
                                                        • String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
                                                        • API String ID: 1811509786-3425311760
                                                        • Opcode ID: 771c0041bee94320fe8ee037342c80956864859d73fe4a819fb0b44a0ac78a7a
                                                        • Instruction ID: 0b44e9969b95965d8b480084f3c665763fd2a61b3cf4f8b9966d4ccce13a43eb
                                                        • Opcode Fuzzy Hash: 771c0041bee94320fe8ee037342c80956864859d73fe4a819fb0b44a0ac78a7a
                                                        • Instruction Fuzzy Hash: 82110533840127FBDF226694CD0AF9DFA65EF10720F240219F811B71A1E7229E50A6F1
                                                        Function 00DDCF25 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?), ref: 00DDCF37
                                                        • GetLastError.KERNEL32(?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00DDCF41
                                                        • GetExitCodeThread.KERNEL32(00000001,?,?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?,00000000), ref: 00DDCF7D
                                                        • GetLastError.KERNEL32(?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00DDCF87
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                        • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
                                                        • API String ID: 3686190907-1954264426
                                                        • Opcode ID: 3dcdd9f5d8b5fba9b34b1afcc0b3bfd74effc1a58b9f6a1f2ce04fce76e1b169
                                                        • Instruction ID: 8762e3ed03de96c1b4cd1dc946b2c34cf198182d38b17cdf20ef41bf21dc56e7
                                                        • Opcode Fuzzy Hash: 3dcdd9f5d8b5fba9b34b1afcc0b3bfd74effc1a58b9f6a1f2ce04fce76e1b169
                                                        • Instruction Fuzzy Hash: 24012673A96637ABC73157A58C05ADF7A59AF04B61F020116BE04BB290E751CD40C1F4
                                                        Function 00DD69AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00DD6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00DD69BB
                                                        • GetLastError.KERNEL32(?,00DD6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00DD69C5
                                                        • GetExitCodeThread.KERNEL32(00000001,00000000,?,00DD6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00DD6A04
                                                        • GetLastError.KERNEL32(?,00DD6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00DD6A0E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                        • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
                                                        • API String ID: 3686190907-2546940223
                                                        • Opcode ID: 2448141c6b786320fcea3f4be7ebd7cee052edf2482d00dfe9bc36f7c0ee04f3
                                                        • Instruction ID: e7c175bbcba449cf6206ff953fb3bd08a3cf82fe1529fe86b6cbfdc60c4fcb0e
                                                        • Opcode Fuzzy Hash: 2448141c6b786320fcea3f4be7ebd7cee052edf2482d00dfe9bc36f7c0ee04f3
                                                        • Instruction Fuzzy Hash: 2B116570780206FFDB109FA19D02B6E76A8EF04751F10516AB944FA3A0EB36CF449BB4
                                                        Function 00DDF7D9 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DDF7EE
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DDF8FB
                                                        Strings
                                                        • UX denied while trying to set source on embedded payload: %ls, xrefs: 00DDF870
                                                        • UX requested unknown payload with id: %ls, xrefs: 00DDF85A
                                                        • UX requested unknown container with id: %ls, xrefs: 00DDF8BA
                                                        • Failed to set source path for container., xrefs: 00DDF8E0
                                                        • Failed to set source path for payload., xrefs: 00DDF88A
                                                        • user is active, cannot change user state., xrefs: 00DDF808
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: user is active, cannot change user state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                        • API String ID: 3168844106-4121889706
                                                        • Opcode ID: 70259c5015d5450bb1e0a52562ce3bb34cef24a2b8466e6dc07084817be3a897
                                                        • Instruction ID: 9af1735ca8d8181b0fe42531f40dffb237f56296a88ae8db8804e3b16837846d
                                                        • Opcode Fuzzy Hash: 70259c5015d5450bb1e0a52562ce3bb34cef24a2b8466e6dc07084817be3a897
                                                        • Instruction Fuzzy Hash: 0231F8B2A01351AF8B119B54CC05EAA77A8EF047207194037F805FB341DB75ED40A7B2
                                                        Function 00DC71FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(00000000), ref: 00DC7210
                                                        Strings
                                                        • Failed to append escape sequence., xrefs: 00DC72A3
                                                        • []{}, xrefs: 00DC723A
                                                        • Failed to format escape sequence., xrefs: 00DC72AA
                                                        • Failed to append characters., xrefs: 00DC729C
                                                        • [\%c], xrefs: 00DC726F
                                                        • Failed to allocate buffer for escaped string., xrefs: 00DC7227
                                                        • Failed to copy string., xrefs: 00DC72C4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen
                                                        • String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
                                                        • API String ID: 1659193697-3250950999
                                                        • Opcode ID: b100802b983b2b391b4e579659bb94da6548c0ed4a9fb6c65cfd2c16daf063b3
                                                        • Instruction ID: 6f0a352cafda43a5112d12bb99b5931cfa2dfc9e4b275b9375bb2fc2763861b3
                                                        • Opcode Fuzzy Hash: b100802b983b2b391b4e579659bb94da6548c0ed4a9fb6c65cfd2c16daf063b3
                                                        • Instruction Fuzzy Hash: F721D536D0922BBBDB215690CC42FAEBBADDF10721F340119F901B7181DB719E819AF8
                                                        Function 00DE5BDC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(00000000,00000000,00E0B500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,00DE67DE,?,00000001,?,00E0B4A0), ref: 00DE5C45
                                                        Strings
                                                        • Failed to insert execute action., xrefs: 00DE5C9A
                                                        • Failed to plan action for target product., xrefs: 00DE5CF0
                                                        • Failed grow array of ordered patches., xrefs: 00DE5CDE
                                                        • Failed to copy target product code., xrefs: 00DE5D78
                                                        • feclient.dll, xrefs: 00DE5C3B, 00DE5D65
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
                                                        • API String ID: 1825529933-3477540455
                                                        • Opcode ID: 8a02471a971a80b55dacb18e9b453f8127fc9bd85d7792ff2d4a9461d38cdd9c
                                                        • Instruction ID: 0ced9b3547ee4d8867eff4fa36095507bd4db67055f1f89ff56d933f571848cc
                                                        • Opcode Fuzzy Hash: 8a02471a971a80b55dacb18e9b453f8127fc9bd85d7792ff2d4a9461d38cdd9c
                                                        • Instruction Fuzzy Hash: 168155B960078A9FCB14DF59D890AAA77A4FF08368F258569EC158B356C730E851CFA0
                                                        Function 00DFCAED Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00DFD262,00000000,00000000,00000000,00000000,00000000,00DF2F1D), ref: 00DFCB2F
                                                        • __fassign.LIBCMT ref: 00DFCBAA
                                                        • __fassign.LIBCMT ref: 00DFCBC5
                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00DFCBEB
                                                        • WriteFile.KERNEL32(?,00000000,00000000,00DFD262,00000000,?,?,?,?,?,?,?,?,?,00DFD262,00000000), ref: 00DFCC0A
                                                        • WriteFile.KERNEL32(?,00000000,00000001,00DFD262,00000000,?,?,?,?,?,?,?,?,?,00DFD262,00000000), ref: 00DFCC43
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                        • String ID:
                                                        • API String ID: 1324828854-0
                                                        • Opcode ID: 079e062b695555a3de3c71aedddb787f2828ab4e2c6644ac8bb361a25e6b4c66
                                                        • Instruction ID: c636b4ece085b7d1c6ad86bf859681371a20b7c0e9731da5fbe555393bf2cabf
                                                        • Opcode Fuzzy Hash: 079e062b695555a3de3c71aedddb787f2828ab4e2c6644ac8bb361a25e6b4c66
                                                        • Instruction Fuzzy Hash: 7C51D171A0024D9FCB20CFA8D985AEEBBF4FF08300F15811AE655F7291E7309955CBA0
                                                        Function 00DE9279 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00DD7113,000000B8,0000001C,00000100), ref: 00DE92A4
                                                        • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00E0B4B8,000000FF,?,?,?,00DD7113,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00DE932E
                                                        Strings
                                                        • BA aborted detect forward compatible bundle., xrefs: 00DE9398
                                                        • detect.cpp, xrefs: 00DE938E
                                                        • comres.dll, xrefs: 00DE93B0
                                                        • Failed to initialize update bundle., xrefs: 00DE93D1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
                                                        • API String ID: 1825529933-439563586
                                                        • Opcode ID: d35a67850d80bb621c216e9db4be4b57cf97dc097d384004776fb3c9629ea47c
                                                        • Instruction ID: 309946bdaa212822958a526b2d460c51a3bd11169eeeb87dae5de6623f86b2e6
                                                        • Opcode Fuzzy Hash: d35a67850d80bb621c216e9db4be4b57cf97dc097d384004776fb3c9629ea47c
                                                        • Instruction Fuzzy Hash: 3F51D270201241BFDF15AF66CC91EA9F766FF05310F544259F9249A2A1C771E860CBB4
                                                        Function 00DDAB9E Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 140COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(00DC5479,000000FF,00AAC56B,E900E0BA,00DC53BD,00000000,?,E900E0BA,00000000), ref: 00DDAC94
                                                        • GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00DC5479,000000FF,00AAC56B,E900E0BA,00DC53BD,00000000,?,E900E0BA,00000000), ref: 00DDACD8
                                                        Strings
                                                        • Failed to get signer chain from authenticode certificate., xrefs: 00DDAD06
                                                        • Failed to get provider state from authenticode certificate., xrefs: 00DDACC2
                                                        • Failed to verify expected payload against actual certificate chain., xrefs: 00DDAD1E
                                                        • Failed authenticode verification of payload: %ls, xrefs: 00DDAC75
                                                        • cache.cpp, xrefs: 00DDAC6A, 00DDACB8, 00DDACFC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast
                                                        • String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp
                                                        • API String ID: 1452528299-2590768268
                                                        • Opcode ID: 6a89905fd219903b8c5a4cd087ec168f2cad6502984fea316fb07bc902b493a8
                                                        • Instruction ID: 95267a4d828be3027867bc8c150b9e65eb33a167f00340e3345d98c3f4d19067
                                                        • Opcode Fuzzy Hash: 6a89905fd219903b8c5a4cd087ec168f2cad6502984fea316fb07bc902b493a8
                                                        • Instruction Fuzzy Hash: 11417676D41229ABDB119B99CC46BDFBBB8EF04720F15412AF900BB381E7719D448AF1
                                                        Function 00DDD437 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CloseHandle.KERNEL32(00000000,?,?,00000001,00E0B500,?,00000001,000000FF,?,?,7694B390,00000000,00000001,00000000,?,00DD74E6), ref: 00DDD560
                                                        Strings
                                                        • UX aborted elevation requirement., xrefs: 00DDD475
                                                        • Failed to elevate., xrefs: 00DDD542
                                                        • elevation.cpp, xrefs: 00DDD46B
                                                        • Failed to create pipe name and client token., xrefs: 00DDD4A1
                                                        • Failed to create pipe and cache pipe., xrefs: 00DDD4BD
                                                        • Failed to connect to elevated child process., xrefs: 00DDD549
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle
                                                        • String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
                                                        • API String ID: 2962429428-3003415917
                                                        • Opcode ID: 93bc7d98338537707e8a41c7aafee559570c784fdc55c8712e756ed666ab87fb
                                                        • Instruction ID: 4475ed38aa7546dff53f9606b57129a3fa8e7ee5b42ba4a0b3ab1278e53fec5b
                                                        • Opcode Fuzzy Hash: 93bc7d98338537707e8a41c7aafee559570c784fdc55c8712e756ed666ab87fb
                                                        • Instruction Fuzzy Hash: 39312B72648726BBEB2596A4DC43FBAB75EEF01724F104217F904BB381DB61AD4082F5
                                                        Function 00DDD24B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 118threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateThread.KERNEL32(00000000,00000000,00DDAD40,?,00000000,00000000), ref: 00DDD2E9
                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DDD2F5
                                                          • Part of subcall function 00DDCF25: WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?), ref: 00DDCF37
                                                          • Part of subcall function 00DDCF25: GetLastError.KERNEL32(?,?,00DDD365,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 00DDCF41
                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?,00DDC7C9,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 00DDD376
                                                        Strings
                                                        • Failed to pump messages in child process., xrefs: 00DDD34D
                                                        • elevation.cpp, xrefs: 00DDD319
                                                        • Failed to create elevated cache thread., xrefs: 00DDD323
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
                                                        • String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
                                                        • API String ID: 3606931770-4134175193
                                                        • Opcode ID: 965f220d09ae2f1776d46786c0a43e8b420302115988b7c9f7787f8df9186ed5
                                                        • Instruction ID: 972f8d795948cff0275c3a55d8d17e045404598995a0bb68cac19b2d2c564741
                                                        • Opcode Fuzzy Hash: 965f220d09ae2f1776d46786c0a43e8b420302115988b7c9f7787f8df9186ed5
                                                        • Instruction Fuzzy Hash: AD41E3B6D01219AFCB15DFA9D8859DEBBF9FF48710F10412AF918A7340E770A9418BA4
                                                        Function 00E00523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00E2B5FC,00000000,?,?,?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?), ref: 00E00533
                                                        • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00E2B5F4,?,00DD4207,00000000,Setup), ref: 00E005D7
                                                        • GetLastError.KERNEL32(?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?,?,?), ref: 00E005E7
                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?), ref: 00E00621
                                                          • Part of subcall function 00DC2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00DC2F09
                                                        • LeaveCriticalSection.KERNEL32(00E2B5FC,?,?,00E2B5F4,?,00DD4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00DC54FA,?), ref: 00E0067A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                        • String ID: logutil.cpp
                                                        • API String ID: 4111229724-3545173039
                                                        • Opcode ID: 6697557537e25149057e3e77a383613624cd648e22b1ba25aea45f8f9ff5743b
                                                        • Instruction ID: 34dbf226d6ebe7b57f7df2c2f75c9812ffd7d5b283ffc844e15820b50db80ad1
                                                        • Opcode Fuzzy Hash: 6697557537e25149057e3e77a383613624cd648e22b1ba25aea45f8f9ff5743b
                                                        • Instruction Fuzzy Hash: 0531D23294062AFFDB219F62ED45F6A776AFB00754F041125F901BB1E0DB72CDA09BA0
                                                        Function 00DE398D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DE39F4
                                                        Strings
                                                        • Failed to append property string part., xrefs: 00DE3A68
                                                        • %s%="%s", xrefs: 00DE3A27
                                                        • Failed to format property string part., xrefs: 00DE3A6F
                                                        • Failed to format property value., xrefs: 00DE3A7D
                                                        • Failed to escape string., xrefs: 00DE3A76
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16
                                                        • String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
                                                        • API String ID: 3613110473-515423128
                                                        • Opcode ID: 94cf34d973ac53ce6991d203379ddf1b8a77721836520aebdb712f51f86cc73b
                                                        • Instruction ID: 5a2b06f94d0a94a03d82e6ebc5010ab31c8ebc5b9d02314ece37c10c673caf51
                                                        • Opcode Fuzzy Hash: 94cf34d973ac53ce6991d203379ddf1b8a77721836520aebdb712f51f86cc73b
                                                        • Instruction Fuzzy Hash: 9F31803290425AABCB15AE99CC4AEBEB768EF00714F10426AF851B7251D771DF90DBB0
                                                        Function 00E041E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00E0432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DDA063,00000001), ref: 00E04203
                                                        • GetLastError.KERNEL32(00000002,?,00E0432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DDA063,00000001,000007D0,00000001,00000001,00000003), ref: 00E04212
                                                        • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,00E0432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DDA063,00000001), ref: 00E042A6
                                                        • GetLastError.KERNEL32(?,00E0432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,00DDA063,00000001,000007D0,00000001), ref: 00E042B0
                                                          • Part of subcall function 00E04440: FindFirstFileW.KERNEL32(00DE923A,?,00000100,00000000,00000000), ref: 00E0447B
                                                          • Part of subcall function 00E04440: FindClose.KERNEL32(00000000), ref: 00E04487
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorFindLastMove$CloseFirst
                                                        • String ID: \$fileutil.cpp
                                                        • API String ID: 3479031965-1689471480
                                                        • Opcode ID: 4c4bb38c08c70404a2ccc4a90f7c3f4ba49f979e0db0045d61d86d2b9adb8e12
                                                        • Instruction ID: f3ad4452f6f8370929905b2da9e2082c1da5c092904efaf8f3250b74979eb07c
                                                        • Opcode Fuzzy Hash: 4c4bb38c08c70404a2ccc4a90f7c3f4ba49f979e0db0045d61d86d2b9adb8e12
                                                        • Instruction Fuzzy Hash: B831D4F6B01226DBDB215E95CE00A6F7669FF52764B115139FE44BB2E0D3718DC086D0
                                                        Function 00DC732C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00DC5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 00DC733E
                                                        • LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00DC5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 00DC741D
                                                        Strings
                                                        • Failed to format value '%ls' of variable: %ls, xrefs: 00DC73E7
                                                        • *****, xrefs: 00DC73D9, 00DC73E6
                                                        • Failed to get variable: %ls, xrefs: 00DC737F
                                                        • Failed to get value as string for variable: %ls, xrefs: 00DC740C
                                                        • Failed to get unformatted string., xrefs: 00DC73AE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
                                                        • API String ID: 3168844106-2873099529
                                                        • Opcode ID: 5dec098b2ac5906c136af714c3c2a6fa0a69bbbfd22ba6c05bfcf61868ce69a1
                                                        • Instruction ID: 0b098af172a5f8bb4c61a6e3e14a3b0710d8736d9b8ae157f6d3a9f695f14d3c
                                                        • Opcode Fuzzy Hash: 5dec098b2ac5906c136af714c3c2a6fa0a69bbbfd22ba6c05bfcf61868ce69a1
                                                        • Instruction Fuzzy Hash: 30317C3290866BFBCF226B90CC05FAE7A64FF14361F104269F81467191D771AA919FF4
                                                        Function 00DD8DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00DD8E37
                                                        • GetLastError.KERNEL32 ref: 00DD8E41
                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00DD8EA1
                                                        Strings
                                                        • Failed to initialize ACL., xrefs: 00DD8E6F
                                                        • Failed to allocate administrator SID., xrefs: 00DD8E1D
                                                        • cache.cpp, xrefs: 00DD8E65
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileInitializeLast
                                                        • String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
                                                        • API String ID: 669721577-1117388985
                                                        • Opcode ID: bf8bb686a96f5a8c56cad547744ec76a0228c27dc3b94966f983fb597dea51dc
                                                        • Instruction ID: e2cf91d6fa8d6b776adb121b37d7010de500db5ccfb7ecbef2ce8f3ebe2b5f0f
                                                        • Opcode Fuzzy Hash: bf8bb686a96f5a8c56cad547744ec76a0228c27dc3b94966f983fb597dea51dc
                                                        • Instruction Fuzzy Hash: B221A872E40214BBDB229A959C45F9FF769FB44B10F51416AFD44FB380DA729D009BB0
                                                        Function 00DC4212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00DD4028,00000001,feclient.dll,?,00000000,?,?,?,00DC4B12), ref: 00DC424D
                                                        • GetLastError.KERNEL32(?,?,00DD4028,00000001,feclient.dll,?,00000000,?,?,?,00DC4B12,?,?,00E0B488,?,00000001), ref: 00DC4259
                                                        • GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00DD4028,00000001,feclient.dll,?,00000000,?,?,?,00DC4B12,?), ref: 00DC4294
                                                        • GetLastError.KERNEL32(?,?,00DD4028,00000001,feclient.dll,?,00000000,?,?,?,00DC4B12,?,?,00E0B488,?,00000001), ref: 00DC429E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryErrorLast
                                                        • String ID: crypt32.dll$dirutil.cpp
                                                        • API String ID: 152501406-1104880720
                                                        • Opcode ID: 2ed0b1404c37ff411e26980bb7add5ab9f452f495d7be1219c7384a06e55dfff
                                                        • Instruction ID: 83026192f8dc621420fa0939817e05b7e3e5ffeb07382cb0bb2612eba556374a
                                                        • Opcode Fuzzy Hash: 2ed0b1404c37ff411e26980bb7add5ab9f452f495d7be1219c7384a06e55dfff
                                                        • Instruction Fuzzy Hash: D711A577E01637AB97215ADA8956F6BFA98EF05760715012DFD40F7250EB21DC0086F8
                                                        Function 00DE0B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00DE0C2B
                                                        • Failed to write during cabinet extraction., xrefs: 00DE0C35
                                                        • Unexpected call to CabWrite()., xrefs: 00DE0BC1
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastWrite_memcpy_s
                                                        • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                        • API String ID: 1970631241-3111339858
                                                        • Opcode ID: dab99fdf2509b258ef88ea320dcec8186247a5a53823a3cbfc1e38d859cdddfd
                                                        • Instruction ID: 7730e82d0b35f69d0ea9735a198c100603cc815971ed8d5e37dde197c9f87cd2
                                                        • Opcode Fuzzy Hash: dab99fdf2509b258ef88ea320dcec8186247a5a53823a3cbfc1e38d859cdddfd
                                                        • Instruction Fuzzy Hash: B4210176500205ABCB11EF5ED881DAA3BB9FF84320B294159FE04E7241E6B2DD80CB70
                                                        Function 00DC9AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9AFB
                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,00000000,?,00DCA8B4,00000100,000002C0,000002C0,00000100), ref: 00DC9B10
                                                        • GetLastError.KERNEL32(?,00DCA8B4,00000100,000002C0,000002C0,00000100), ref: 00DC9B1B
                                                        Strings
                                                        • Failed while searching directory search: %ls, for path: %ls, xrefs: 00DC9B54
                                                        • Failed to format variable string., xrefs: 00DC9B06
                                                        • Failed to set variable., xrefs: 00DC9B7A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesErrorFileLastOpen@16
                                                        • String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
                                                        • API String ID: 1811509786-402580132
                                                        • Opcode ID: 0b1bd7faaee6e5e5cfd777c4d0f0247510d0ca3fcd027a5fb0d6b481f921aed6
                                                        • Instruction ID: 064277106671a98154a8e341c23b55754d8f01b26b8cb005654eaec1d52788da
                                                        • Opcode Fuzzy Hash: 0b1bd7faaee6e5e5cfd777c4d0f0247510d0ca3fcd027a5fb0d6b481f921aed6
                                                        • Instruction Fuzzy Hash: 6311E932940537FBDB221698ACDAF6EF65AEF00760F100329FD10771A0C7219D50A6F4
                                                        Function 00DE0C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00DE0CC4
                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DE0CD6
                                                        • SetFileTime.KERNEL32(?,?,?,?), ref: 00DE0CE9
                                                        • CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00DE08B1,?,?), ref: 00DE0CF8
                                                        Strings
                                                        • Invalid operation for this state., xrefs: 00DE0C9D
                                                        • cabextract.cpp, xrefs: 00DE0C93
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Time$File$CloseDateHandleLocal
                                                        • String ID: Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 609741386-1751360545
                                                        • Opcode ID: d76a1954335fedb8dd26f97339f48ee25cbc44432a1ffefe1ac13db540cc2d73
                                                        • Instruction ID: ab68f39b81a5b34c461d566b5dae2108d02d2044c0ee8c49e2c7d1d1dd38dc8e
                                                        • Opcode Fuzzy Hash: d76a1954335fedb8dd26f97339f48ee25cbc44432a1ffefe1ac13db540cc2d73
                                                        • Instruction Fuzzy Hash: 1C21C671801619AFC710AFA9DD099FABBBCFF047207148216F454E6590D3B1E991CBA0
                                                        Function 00DD4A77 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,crypt32.dll,00000000,00000000,00000000,?,00DD539D), ref: 00DD4AC3
                                                        Strings
                                                        • Failed to allocate message to write., xrefs: 00DD4AA2
                                                        • Failed to write message type to pipe., xrefs: 00DD4B05
                                                        • pipe.cpp, xrefs: 00DD4AFB
                                                        • crypt32.dll, xrefs: 00DD4A7D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FileWrite
                                                        • String ID: Failed to allocate message to write.$Failed to write message type to pipe.$crypt32.dll$pipe.cpp
                                                        • API String ID: 3934441357-606776022
                                                        • Opcode ID: 43464d2a1d884f6e472449e973204890cf412c69c7ad0f5f75367802ea630d39
                                                        • Instruction ID: ca3374734e82c4941156ec0d8d2d6015ece101f74226fe165bb0c42a8a14ceeb
                                                        • Opcode Fuzzy Hash: 43464d2a1d884f6e472449e973204890cf412c69c7ad0f5f75367802ea630d39
                                                        • Instruction Fuzzy Hash: 65118972A81229BBCB218E95DD05EDF7AA8EF40750F114066F900B6390EB31DE50D6B0
                                                        Function 00DD4642 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • _memcpy_s.LIBCMT ref: 00DD4693
                                                        • _memcpy_s.LIBCMT ref: 00DD46A6
                                                        • _memcpy_s.LIBCMT ref: 00DD46C1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: _memcpy_s$Heap$AllocateProcess
                                                        • String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
                                                        • API String ID: 886498622-766083570
                                                        • Opcode ID: 1170b04606f7d299b570f06a9c4bb72119187f602584162cf0dd6308493d5d83
                                                        • Instruction ID: f4c6e53b8b22bcac662cd8010d2eecd15ac03b1cee274db5de3354dd0d815db7
                                                        • Opcode Fuzzy Hash: 1170b04606f7d299b570f06a9c4bb72119187f602584162cf0dd6308493d5d83
                                                        • Instruction Fuzzy Hash: 5311A0B210030AABDB01EE94CC82DEB77ADEF05B10B00452AFA11DB291DB71EA54C7F1
                                                        Function 00DC9A4D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00DC9AC4
                                                        Strings
                                                        • Failed to copy condition string from BSTR, xrefs: 00DC9AAE
                                                        • `Dv, xrefs: 00DC9AC4
                                                        • Failed to select condition node., xrefs: 00DC9A7B
                                                        • Failed to get Condition inner text., xrefs: 00DC9A94
                                                        • Condition, xrefs: 00DC9A5F
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeString
                                                        • String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`Dv
                                                        • API String ID: 3341692771-1896785106
                                                        • Opcode ID: b2d152fc323af3137165d9ce23a519bb84d4db75af54ce2a9bc3d5433c4dc093
                                                        • Instruction ID: 1af0cc9835a2908c7a98e771299b1d977c628e2f37b68c5e63d2a6d0685cdc40
                                                        • Opcode Fuzzy Hash: b2d152fc323af3137165d9ce23a519bb84d4db75af54ce2a9bc3d5433c4dc093
                                                        • Instruction Fuzzy Hash: 6B11A571905325BBDB169A94CD1AFADF768EF00711F144158FC00FB190C7B19E80D7A0
                                                        Function 00DC67AA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 00DC67E3
                                                        • GetLastError.KERNEL32 ref: 00DC67ED
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastPathTemp
                                                        • String ID: 4#v$Failed to get temp path.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 1238063741-2550301277
                                                        • Opcode ID: 79a30af840f67a1db8fd38efc9ca89eaeeabcf36df16da190b291e6ec191aed8
                                                        • Instruction ID: 7307ff334dfd990d6996823fd2e027e335b4c49848c7d260a9a2950495c2b7ed
                                                        • Opcode Fuzzy Hash: 79a30af840f67a1db8fd38efc9ca89eaeeabcf36df16da190b291e6ec191aed8
                                                        • Instruction Fuzzy Hash: 3D01F972E4133A6BD720AB559C06FAE7798DF04B10F100169FD04FB2C2EA61DD448AF5
                                                        Function 00E096CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                        • API String ID: 0-1718035505
                                                        • Opcode ID: 3571d108faaa981de07d532f1f0b53fedac39e9480531f54fd06ef52de36564e
                                                        • Instruction ID: 1cd863c067c56df378b34f6b35ff4f954d8cf2969f1c14638d9ddb094d34e6fa
                                                        • Opcode Fuzzy Hash: 3571d108faaa981de07d532f1f0b53fedac39e9480531f54fd06ef52de36564e
                                                        • Instruction Fuzzy Hash: B10181727923329FCF300E667CD49A723889B11399318717BE562F3183EB5288C99690
                                                        Function 00E00ACC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00DC5EB2,00000000), ref: 00E00AE0
                                                        • GetProcAddress.KERNEL32(00000000), ref: 00E00AE7
                                                        • GetLastError.KERNEL32(?,?,?,00DC5EB2,00000000), ref: 00E00AFE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorHandleLastModuleProc
                                                        • String ID: IsWow64Process$kernel32$procutil.cpp
                                                        • API String ID: 4275029093-1586155540
                                                        • Opcode ID: 5395211dbc204ea218ce211ee1f19144db2478aade4dec1a8e1b2b56737dbd68
                                                        • Instruction ID: 01fe7ecaf6b1c9feca253e5d10b5d88daea49584a20701dcecf9f3f043696177
                                                        • Opcode Fuzzy Hash: 5395211dbc204ea218ce211ee1f19144db2478aade4dec1a8e1b2b56737dbd68
                                                        • Instruction Fuzzy Hash: 86F0A472A4023AABC7249B959C09E9BBB68EF00B54F015154BD04B72C0EB71DE808BE0
                                                        Function 00DFA20B Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00DF3479,00DF3479,?,?,?,00DFA45C,00000001,00000001,ECE85006), ref: 00DFA265
                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00DFA45C,00000001,00000001,ECE85006,?,?,?), ref: 00DFA2EB
                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,ECE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DFA3E5
                                                        • __freea.LIBCMT ref: 00DFA3F2
                                                          • Part of subcall function 00DF521A: HeapAlloc.KERNEL32(00000000,?,?,?,00DF1F87,?,0000015D,?,?,?,?,00DF33E0,000000FF,00000000,?,?), ref: 00DF524C
                                                        • __freea.LIBCMT ref: 00DFA3FB
                                                        • __freea.LIBCMT ref: 00DFA420
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide__freea$AllocHeap
                                                        • String ID:
                                                        • API String ID: 3147120248-0
                                                        • Opcode ID: 87d65390f12095af4499091af4791b8c03d27bda6b51a700d97b1e2bde2ac10f
                                                        • Instruction ID: 1d7fe982298ab2e4af32a645661cdfad2f74646ce47e00f3fb38617802088fed
                                                        • Opcode Fuzzy Hash: 87d65390f12095af4499091af4791b8c03d27bda6b51a700d97b1e2bde2ac10f
                                                        • Instruction Fuzzy Hash: 2D51C7B261021AAFDB294FA8CC41EBF77E9EF44750F1A8629FE08D6140DB75DC809671
                                                        Function 00DD8CAC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00DD8D18
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Sleep
                                                        • String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
                                                        • API String ID: 3472027048-398165853
                                                        • Opcode ID: 292eeb0f6fedc467142d385dcc3f48baff7b74bafb7dba500d2ef6797972614b
                                                        • Instruction ID: 24a4e41d1b564dabe80beb72ce8cf2055f00b2d40dddf4cf30d9edfff5150570
                                                        • Opcode Fuzzy Hash: 292eeb0f6fedc467142d385dcc3f48baff7b74bafb7dba500d2ef6797972614b
                                                        • Instruction Fuzzy Hash: AF31E372A40225BFEB23AA648D42FBF626EEF60710F154026FD00F63D1DA75DD40A6B1
                                                        Function 00DDE956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DefWindowProcW.USER32(?,00000082,?,?), ref: 00DDE985
                                                        • SetWindowLongW.USER32(?,000000EB,00000000), ref: 00DDE994
                                                        • SetWindowLongW.USER32(?,000000EB,?), ref: 00DDE9A8
                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00DDE9B8
                                                        • GetWindowLongW.USER32(?,000000EB), ref: 00DDE9D2
                                                        • PostQuitMessage.USER32(00000000), ref: 00DDEA31
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$Proc$MessagePostQuit
                                                        • String ID:
                                                        • API String ID: 3812958022-0
                                                        • Opcode ID: 0df9a83b0f6f0c8c121dd2f8bdac067e2ee178a40e08e22c6564b467c818ddc5
                                                        • Instruction ID: 228d544af9dc9f3553a1d022a211c724c13a66ec3459f8e07bece9c7315ae9c6
                                                        • Opcode Fuzzy Hash: 0df9a83b0f6f0c8c121dd2f8bdac067e2ee178a40e08e22c6564b467c818ddc5
                                                        • Instruction Fuzzy Hash: 7921C531104105BFDF15AFA8DC49E6A3B66FF45310F184619FA0AAA2A4C731DD50DB71
                                                        Function 00DDC7C9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • elevation.cpp, xrefs: 00DDC9B8
                                                        • Unexpected elevated message sent to child process, msg: %u, xrefs: 00DDC9C4
                                                        • Failed to save state., xrefs: 00DDC891
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandleMutexRelease
                                                        • String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
                                                        • API String ID: 4207627910-1576875097
                                                        • Opcode ID: 119c46e01b64924b6ab90ca63b200334f2112a7e521e7f9fc3a9b47c62b95bb8
                                                        • Instruction ID: 905b22767a0778aa0e8ad85f966966f1ec3fbcaeda8dd7cc35156c353161e053
                                                        • Opcode Fuzzy Hash: 119c46e01b64924b6ab90ca63b200334f2112a7e521e7f9fc3a9b47c62b95bb8
                                                        • Instruction Fuzzy Hash: 6B61D83A110605FFCB225F84CD01C65BBB2FF08325B15D55AFA999A632C732E821EF61
                                                        Function 00E07B16 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07C74
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07C7F
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07C8A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeString$Heap$AllocateProcess
                                                        • String ID: `Dv$atomutil.cpp
                                                        • API String ID: 2724874077-1153537316
                                                        • Opcode ID: cda99dbf2f4c412cfa067ae6bf6b2448b7cbe9b2b54cc9b605f850b7562883ee
                                                        • Instruction ID: f4d9b01e4e8337d8297b01fa47eb1d49225a08a8558c2ac98846c5219c9a3743
                                                        • Opcode Fuzzy Hash: cda99dbf2f4c412cfa067ae6bf6b2448b7cbe9b2b54cc9b605f850b7562883ee
                                                        • Instruction Fuzzy Hash: 85519231D1422AAFDB25DF64C884FAEB7B8EF04714F155198E945BB190DB71EE80CBA0
                                                        Function 00E01217 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 150registrystringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00E0123F
                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00DD70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00E01276
                                                        • lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00E0136E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$lstrlen
                                                        • String ID: BundleUpgradeCode$regutil.cpp
                                                        • API String ID: 3790715954-1648651458
                                                        • Opcode ID: 38a5a10c92d0d1fd954500918db0a37b8ce15ef2394975cbd7d153b2eca11698
                                                        • Instruction ID: 00e34d0b9c105a506ef45025ee49c4d816ca676fda0ff9e3738736ab88b5e0b4
                                                        • Opcode Fuzzy Hash: 38a5a10c92d0d1fd954500918db0a37b8ce15ef2394975cbd7d153b2eca11698
                                                        • Instruction Fuzzy Hash: 9141D335A0021AEFCB219F95C880EBEB7A9EF44714F1651A9FD01FF690D6349D809BA0
                                                        Function 00E08713 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00E08820
                                                        • GetLastError.KERNEL32 ref: 00E0882A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Time$ErrorFileLastSystem
                                                        • String ID: Hr$clbcatq.dll$timeutil.cpp
                                                        • API String ID: 2781989572-447003484
                                                        • Opcode ID: 0a5a7a775d74a54fa6c20e2e0dcf34cac6cee452733ff25ae2ddd3b3d27240b3
                                                        • Instruction ID: 4fc7fca948cf2d80869023555755c68cf7b1ea1dc5cf150fbbc968bee4096859
                                                        • Opcode Fuzzy Hash: 0a5a7a775d74a54fa6c20e2e0dcf34cac6cee452733ff25ae2ddd3b3d27240b3
                                                        • Instruction Fuzzy Hash: 4D410976E0021A66D7249BB48E05BBF7775EF40704F95952AF641B72C4ED31CE8087B1
                                                        Function 00E06357 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E0490D: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00DD8770,00000000,00000000,00000000,00000000,00000000), ref: 00E04925
                                                          • Part of subcall function 00E0490D: GetLastError.KERNEL32(?,?,?,00DD8770,00000000,00000000,00000000,00000000,00000000), ref: 00E0492F
                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00E05C09,?,?,?,?,?,?,?,00010000,?), ref: 00E063C0
                                                        • WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00E05C09,?,?,?,?), ref: 00E06412
                                                        • GetLastError.KERNEL32(?,00E05C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00E06458
                                                        • GetLastError.KERNEL32(?,00E05C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00E0647E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$Write$Pointer
                                                        • String ID: dlutil.cpp
                                                        • API String ID: 133221148-2067379296
                                                        • Opcode ID: acc7c858e78759695f5261a1ae3246a0a04aee79e5fc225d27ad33a208cd9cb0
                                                        • Instruction ID: 9f39e0a14ef99874bf713bab8acef2c852facdcbd734039807057a91a28e19b7
                                                        • Opcode Fuzzy Hash: acc7c858e78759695f5261a1ae3246a0a04aee79e5fc225d27ad33a208cd9cb0
                                                        • Instruction Fuzzy Hash: 95419C7290022ABFEB218E94CD85BAE7BA9FF04724F155225FD10B61D0D771DDA0DBA0
                                                        Function 00DC2428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00DFFFEF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DFFFEF,00DE12CF,?,00000000), ref: 00DC246E
                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DFFFEF,00DE12CF,?,00000000,0000FDE9,?,00DE12CF), ref: 00DC247A
                                                          • Part of subcall function 00DC3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BDB
                                                          • Part of subcall function 00DC3BD3: HeapSize.KERNEL32(00000000,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BE2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                        • String ID: strutil.cpp
                                                        • API String ID: 3662877508-3612885251
                                                        • Opcode ID: 2727cd3c161822b2aeb5bda5dc412bef20f3bd3971c15cdd850f8c144243ab54
                                                        • Instruction ID: d721c33db73c0e09adaa23a179df5127a0eccd1f8e672e78a1349e298fef0e65
                                                        • Opcode Fuzzy Hash: 2727cd3c161822b2aeb5bda5dc412bef20f3bd3971c15cdd850f8c144243ab54
                                                        • Instruction Fuzzy Hash: AF31D03020421BEFE7149E698CC4F77339DEB64364B24822DFA51AB2A0EB71CC4196B0
                                                        Function 00DEAD44 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00DEADB3
                                                        Strings
                                                        • Failed to extract all payloads from container: %ls, xrefs: 00DEADF7
                                                        • Failed to open container: %ls., xrefs: 00DEAD85
                                                        • Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00DEAE4A
                                                        • Failed to extract payload: %ls from container: %ls, xrefs: 00DEAE3E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
                                                        • API String ID: 1825529933-3891707333
                                                        • Opcode ID: f3dcab917fa47ae5a353fe60bb135f8b923631a6a5ddd3f3fcf84239b2d0144a
                                                        • Instruction ID: 83602141654f264bb17902a75366507e0411e573e48b12e8c099b4457afeb535
                                                        • Opcode Fuzzy Hash: f3dcab917fa47ae5a353fe60bb135f8b923631a6a5ddd3f3fcf84239b2d0144a
                                                        • Instruction Fuzzy Hash: B631C472D00256ABCF21AAE9CC46E9E7768EF04B10F144211FE10B7191E731AA55DBB1
                                                        Function 00E07A10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07AF4
                                                        • SysFreeString.OLEAUT32(?), ref: 00E07AFF
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E07B0A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeString$Heap$AllocateProcess
                                                        • String ID: `Dv$atomutil.cpp
                                                        • API String ID: 2724874077-1153537316
                                                        • Opcode ID: 91e52788999e6db71f9092df339a2820c2102e6b065e1c44ce8c68df2f4bb83f
                                                        • Instruction ID: fc39488fa02d5108653cf76b92dfd272edd449d038478935c466ddcad633b639
                                                        • Opcode Fuzzy Hash: 91e52788999e6db71f9092df339a2820c2102e6b065e1c44ce8c68df2f4bb83f
                                                        • Instruction Fuzzy Hash: 5231A632D04229BBCB129F94CC45F9EBBB8EF00750F115155E981BB190D770AE40DBE0
                                                        Function 00DCF005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,00DD0654,00000001,00000001,00000001,00DD0654,00000000), ref: 00DCF07D
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,00DD0654,00000001,00000001,00000001,00DD0654,00000000,00000001,00000000,?,00DD0654,00000001), ref: 00DCF09A
                                                        Strings
                                                        • Failed to remove update registration key: %ls, xrefs: 00DCF0C7
                                                        • PackageVersion, xrefs: 00DCF05E
                                                        • Failed to format key for update registration., xrefs: 00DCF033
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCompareString
                                                        • String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
                                                        • API String ID: 446873843-3222553582
                                                        • Opcode ID: b72a2492bbe314c621f2b9a9cde3c959eca951fa022c99486a4497e914fa577a
                                                        • Instruction ID: 33ba40c4b2582c71e1a24ed25199e5b453edca6ff1731023727532a70e79b549
                                                        • Opcode Fuzzy Hash: b72a2492bbe314c621f2b9a9cde3c959eca951fa022c99486a4497e914fa577a
                                                        • Instruction Fuzzy Hash: 66216632D0122ABADB219BA5CC49FEFBEB9DF05B60F100269F914B7191E7315A40D6A0
                                                        Function 00E0433D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E04440: FindFirstFileW.KERNEL32(00DE923A,?,00000100,00000000,00000000), ref: 00E0447B
                                                          • Part of subcall function 00E04440: FindClose.KERNEL32(00000000), ref: 00E04487
                                                        • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00E04430
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                          • Part of subcall function 00E01217: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00E0123F
                                                          • Part of subcall function 00E01217: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00DD70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00E01276
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseFindQueryValue$FileFirstOpen
                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
                                                        • API String ID: 3397690329-3978359083
                                                        • Opcode ID: 1f2104fe2443fcf4b49b2165585dddc124381c98598b1382b49f1f1df4d15ea5
                                                        • Instruction ID: fe7be90bbf2de72f7d6abf5a105c5b40a8b1c0b6baacf1a68796b7fa3d3fcd41
                                                        • Opcode Fuzzy Hash: 1f2104fe2443fcf4b49b2165585dddc124381c98598b1382b49f1f1df4d15ea5
                                                        • Instruction Fuzzy Hash: 8831B3F1900219EADF21AF81CE41ABEB775EB00754F54A179EA14B61D1D3319EC0CB60
                                                        Function 00E04019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CopyFileW.KERNEL32(00000000,00DC4DBC,00000000,?,?,00000000,?,00E0412D,00000000,00DC4DBC,00000000,00000000,?,00DD85EE,?,?), ref: 00E04033
                                                        • GetLastError.KERNEL32(?,00E0412D,00000000,00DC4DBC,00000000,00000000,?,00DD85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00E04041
                                                        • CopyFileW.KERNEL32(00000000,00DC4DBC,00000000,00DC4DBC,00000000,?,00E0412D,00000000,00DC4DBC,00000000,00000000,?,00DD85EE,?,?,00000001), ref: 00E040AC
                                                        • GetLastError.KERNEL32(?,00E0412D,00000000,00DC4DBC,00000000,00000000,?,00DD85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00E040B6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CopyErrorFileLast
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 374144340-2967768451
                                                        • Opcode ID: ec89e9e0243b825b33e8b5d018a072aaddd1ca8db1c1af01200d29fc92afad50
                                                        • Instruction ID: 225b5c413f7b7ba77480a771a7b6f554f3b480a7a8891b766a55196e22d5c77f
                                                        • Opcode Fuzzy Hash: ec89e9e0243b825b33e8b5d018a072aaddd1ca8db1c1af01200d29fc92afad50
                                                        • Instruction Fuzzy Hash: 6F21C5F76013369BDB300A965E40B7B6698EF14B64B151135FF04FB5D1D7618CC092E2
                                                        Function 00DCEF1B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DCEF56
                                                          • Part of subcall function 00E04153: SetFileAttributesW.KERNEL32(00DE923A,00000080,00000000,00DE923A,000000FF,00000000,?,?,00DE923A), ref: 00E04182
                                                          • Part of subcall function 00E04153: GetLastError.KERNEL32(?,?,00DE923A), ref: 00E0418C
                                                          • Part of subcall function 00DC3C6B: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,00DCEFA1,00000001,00000000,00000095,00000001,00DD0663,00000095,00000000,swidtag,00000001), ref: 00DC3C88
                                                        Strings
                                                        • Failed to format tag folder path., xrefs: 00DCEFC3
                                                        • Failed to allocate regid folder path., xrefs: 00DCEFBC
                                                        • swidtag, xrefs: 00DCEF65
                                                        • Failed to allocate regid file path., xrefs: 00DCEFB5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AttributesDirectoryErrorFileLastOpen@16Remove
                                                        • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
                                                        • API String ID: 1428973842-4170906717
                                                        • Opcode ID: 579bdcaecf75af07a80b44796d91dfe223e293ef77647937b7480f802f7c0195
                                                        • Instruction ID: bc112b63754e695a475c92cd8166a3daa86ac6d638024f729d6187363ac4aca3
                                                        • Opcode Fuzzy Hash: 579bdcaecf75af07a80b44796d91dfe223e293ef77647937b7480f802f7c0195
                                                        • Instruction Fuzzy Hash: E3216972D0061ABBCB11AB99CC41F9DFBB5EF44310F1480ADF514B72A1D7719A91ABA0
                                                        Function 00DE8DB6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00DE8E3A
                                                        • RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00DCF7E0,00000001,00000100,000001B4,00000000), ref: 00DE8E88
                                                        Strings
                                                        • Failed to open uninstall registry key., xrefs: 00DE8DFD
                                                        • Failed to enumerate uninstall key for related bundles., xrefs: 00DE8E99
                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00DE8DD7
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCompareOpenString
                                                        • String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                                                        • API String ID: 2817536665-2531018330
                                                        • Opcode ID: 1a79583cec1167f78530cc0db00d60a5a500958a5d53969887bc3c78ea536acf
                                                        • Instruction ID: b17b9b9b170bda3a2e51f6b854b9c9b3eb9de2b903e85bb41fe56af6375421bc
                                                        • Opcode Fuzzy Hash: 1a79583cec1167f78530cc0db00d60a5a500958a5d53969887bc3c78ea536acf
                                                        • Instruction Fuzzy Hash: B821C932900258FFDF11BA95CC46FEEBA79EB00B20F144164F81476090DB764ED0F6A0
                                                        Function 00DED259 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00DED2EE
                                                        • ReleaseMutex.KERNEL32(?), ref: 00DED31C
                                                        • SetEvent.KERNEL32(?), ref: 00DED325
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
                                                        • String ID: Failed to allocate buffer.$NetFxChainer.cpp
                                                        • API String ID: 944053411-3611226795
                                                        • Opcode ID: 6692f06d6a31086df6a451af48d339395d4a4e4ef0d67bb82665b4098dc2c206
                                                        • Instruction ID: 77aaa2970367fcbcf72b6bf5f6e55490463a78fa3a8f7fb924507dd6eafcbc08
                                                        • Opcode Fuzzy Hash: 6692f06d6a31086df6a451af48d339395d4a4e4ef0d67bb82665b4098dc2c206
                                                        • Instruction Fuzzy Hash: 9421B5B4600346FFDB10AF69D844A59B7F6FF48320F148629F964A7361C771E9508BA0
                                                        Function 00E05907 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00DE6B11,00000000,?), ref: 00E0591D
                                                        • GetLastError.KERNEL32(?,?,00DE6B11,00000000,?,?,?,?,?,?,?,?,?,00DE6F28,?,?), ref: 00E0592B
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00DE6B11,00000000,?), ref: 00E05965
                                                        • GetLastError.KERNEL32(?,?,00DE6B11,00000000,?,?,?,?,?,?,?,?,?,00DE6F28,?,?), ref: 00E0596F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ConfigErrorHeapLastQueryService$AllocateProcess
                                                        • String ID: svcutil.cpp
                                                        • API String ID: 355237494-1746323212
                                                        • Opcode ID: 8a55d98854dae2d5ed02b40b799e34c19d9a2a9441fd003a329265ad426a008d
                                                        • Instruction ID: 8f266f879f9f8ec60e2e8c28d87586e3084e568e0f789a1a9ab9bb51edad727a
                                                        • Opcode Fuzzy Hash: 8a55d98854dae2d5ed02b40b799e34c19d9a2a9441fd003a329265ad426a008d
                                                        • Instruction Fuzzy Hash: 16210133941A36EBE7215A918D04FAFBE6DEF80B70F514014BC64BB280E6218D809AF0
                                                        Function 00E03245 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysAllocString.OLEAUT32(?), ref: 00E03258
                                                        • VariantInit.OLEAUT32(?), ref: 00E03264
                                                        • VariantClear.OLEAUT32(?), ref: 00E032D8
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E032E3
                                                          • Part of subcall function 00E03498: SysAllocString.OLEAUT32(?), ref: 00E034AD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$AllocVariant$ClearFreeInit
                                                        • String ID: `Dv
                                                        • API String ID: 347726874-3059127152
                                                        • Opcode ID: 8c34f42439f9a3f7b00beeddd5180720dbb6fa35f2c825785b9a645d019f9753
                                                        • Instruction ID: 4e00a3bf90e6541ef9b17a5cb140fdbba1c3c8a74c30717a60c41f18d38c075d
                                                        • Opcode Fuzzy Hash: 8c34f42439f9a3f7b00beeddd5180720dbb6fa35f2c825785b9a645d019f9753
                                                        • Instruction Fuzzy Hash: E6214C31A01219AFCB14DFA4C858EAEBBBDFF48B15F104158E801AB260D7319E89CB90
                                                        Function 00DC9839 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: _memcpy_s
                                                        • String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
                                                        • API String ID: 2001391462-1605196437
                                                        • Opcode ID: 611365b27f5dd079501b0692ef661c9b9337cb4d00347bdacaafe3ab0b8cd077
                                                        • Instruction ID: 06e78b7125678a539710607276621e8c2b9af444be26a083bbd3bf2500d848e5
                                                        • Opcode Fuzzy Hash: 611365b27f5dd079501b0692ef661c9b9337cb4d00347bdacaafe3ab0b8cd077
                                                        • Instruction Fuzzy Hash: 961104731842227ADB2529AC9C9AF967A54EF06720F044158F9006B1D2CA62C95097F1
                                                        Function 00DC9E16 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 00DC9E38
                                                        Strings
                                                        • Failed to format path string., xrefs: 00DC9E43
                                                        • Failed get file version., xrefs: 00DC9E78
                                                        • Failed to set variable., xrefs: 00DC9E97
                                                        • File search: %ls, did not find path: %ls, xrefs: 00DC9EA3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open@16
                                                        • String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
                                                        • API String ID: 3613110473-2458530209
                                                        • Opcode ID: 33a08d0a1d5ed88dca5bbc857b871660211d23c55047b6824ce296b9ba842002
                                                        • Instruction ID: 5d8aaf97dd6eb1505fc6cefcfcf9e1c7ba155267e8ed5b0d108ebb089be5669e
                                                        • Opcode Fuzzy Hash: 33a08d0a1d5ed88dca5bbc857b871660211d23c55047b6824ce296b9ba842002
                                                        • Instruction Fuzzy Hash: 52119372D4122ABBCB02AED48C45EAEFB7CEF24750F14416AF90077251D7319E509BA1
                                                        Function 00DD820F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        • CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00DD8E17,0000001A,00000000,?,00000000,00000000), ref: 00DD8258
                                                        • GetLastError.KERNEL32(?,?,00DD8E17,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00DD8262
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateCreateErrorKnownLastProcessWell
                                                        • String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
                                                        • API String ID: 2186923214-2110050797
                                                        • Opcode ID: 018f313c2dab46263b796f146e1efc2d009caa21fafb0d1e897bdfe9a2a86bee
                                                        • Instruction ID: a3f0e1bb890ccde79c575d2705b0ea3eb6aa0f73dd594b1b11d8554bf3a6063a
                                                        • Opcode Fuzzy Hash: 018f313c2dab46263b796f146e1efc2d009caa21fafb0d1e897bdfe9a2a86bee
                                                        • Instruction Fuzzy Hash: A1012533646622BBC63266994C06F9B6E6CDF41F70B11401BFD00BB280EE71DD4051F4
                                                        Function 00DEDDA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00DEDDCE
                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DEDDF8
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00DEDFC8,00000000,?,?,?,?,00000000), ref: 00DEDE00
                                                        Strings
                                                        • bitsuser.cpp, xrefs: 00DEDE24
                                                        • Failed while waiting for download., xrefs: 00DEDE2E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessageMultipleObjectsPeekWait
                                                        • String ID: Failed while waiting for download.$bitsuser.cpp
                                                        • API String ID: 435350009-228655868
                                                        • Opcode ID: 5ac1f53f8bba5426d5f1c38e653f3da82e74988a1075ca2421ded9d1fdf95b74
                                                        • Instruction ID: f12e3211973eafe545d18f898b8d58aac88019a78e25d6c8a59807faec5cf529
                                                        • Opcode Fuzzy Hash: 5ac1f53f8bba5426d5f1c38e653f3da82e74988a1075ca2421ded9d1fdf95b74
                                                        • Instruction Fuzzy Hash: DC112973A413757BD7206AAA9C0DEEFBA5DEF04B20F100125FE05FB181DA619D0081F0
                                                        Function 00E03C72 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ShellExecuteExW.SHELL32(?), ref: 00E03CC0
                                                        • GetLastError.KERNEL32(?,?,00000000), ref: 00E03CCA
                                                        • CloseHandle.KERNEL32(?,?,?,00000000), ref: 00E03CFD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseErrorExecuteHandleLastShell
                                                        • String ID: <$shelutil.cpp
                                                        • API String ID: 3023784893-3991740012
                                                        • Opcode ID: 9aa1993682db32a2921df91ecc7297eb7e5ef7175410bff11ddeeb4d675acb6e
                                                        • Instruction ID: b6feac56674295446a286f20eec32d351f625b475aa7d724566757a395321489
                                                        • Opcode Fuzzy Hash: 9aa1993682db32a2921df91ecc7297eb7e5ef7175410bff11ddeeb4d675acb6e
                                                        • Instruction Fuzzy Hash: CD11C7B5E01229ABDB14DFA9D885A8EBBB8AB08754F104115FD15F7340E7319A408BA4
                                                        Function 00DC5F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetComputerNameW.KERNEL32(?,00000010), ref: 00DC5F5C
                                                        • GetLastError.KERNEL32 ref: 00DC5F66
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ComputerErrorLastName
                                                        • String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 3560734967-484636765
                                                        • Opcode ID: c9af3362be0836b2ec0864e9798e713296e49d0827d67254407b50aa43175f0e
                                                        • Instruction ID: 817ab19971c4bf8572c2f15b4b800ce98a1b24e46754d1750ec95300af7724a6
                                                        • Opcode Fuzzy Hash: c9af3362be0836b2ec0864e9798e713296e49d0827d67254407b50aa43175f0e
                                                        • Instruction Fuzzy Hash: 2311A933A456296BD7159B959C05FDEB7E8EF08710F510159FD00FB280DA71AE8486F1
                                                        Function 00DC5E94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(?), ref: 00DC5EA6
                                                          • Part of subcall function 00E00ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00DC5EB2,00000000), ref: 00E00AE0
                                                          • Part of subcall function 00E00ACC: GetProcAddress.KERNEL32(00000000), ref: 00E00AE7
                                                          • Part of subcall function 00E00ACC: GetLastError.KERNEL32(?,?,?,00DC5EB2,00000000), ref: 00E00AFE
                                                          • Part of subcall function 00E03D1F: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00E03D4C
                                                        Strings
                                                        • Failed to get 64-bit folder., xrefs: 00DC5EF0
                                                        • Failed to get shell folder., xrefs: 00DC5EDA
                                                        • Failed to set variant value., xrefs: 00DC5F0A
                                                        • variable.cpp, xrefs: 00DC5ED0
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
                                                        • String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
                                                        • API String ID: 2084161155-3906113122
                                                        • Opcode ID: 745815c8dbf0304b9bbee5c0a2337257e757d3c75cf80bfccfcd937e23e34f85
                                                        • Instruction ID: 41fd3984578352ecc0b30c98854630b2213b3b81d26257a98db5046d4884eec7
                                                        • Opcode Fuzzy Hash: 745815c8dbf0304b9bbee5c0a2337257e757d3c75cf80bfccfcd937e23e34f85
                                                        • Instruction Fuzzy Hash: E001883294571ABBDF16A790DC06FAE7A6CEF00720F205259F800B7195DB71AAD09BF1
                                                        Function 00E04153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E04440: FindFirstFileW.KERNEL32(00DE923A,?,00000100,00000000,00000000), ref: 00E0447B
                                                          • Part of subcall function 00E04440: FindClose.KERNEL32(00000000), ref: 00E04487
                                                        • SetFileAttributesW.KERNEL32(00DE923A,00000080,00000000,00DE923A,000000FF,00000000,?,?,00DE923A), ref: 00E04182
                                                        • GetLastError.KERNEL32(?,?,00DE923A), ref: 00E0418C
                                                        • DeleteFileW.KERNEL32(00DE923A,00000000,00DE923A,000000FF,00000000,?,?,00DE923A), ref: 00E041AC
                                                        • GetLastError.KERNEL32(?,?,00DE923A), ref: 00E041B6
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 3967264933-2967768451
                                                        • Opcode ID: 08f15e549f1c2f343e7a4ee8702ca0bec1d8ac9b8986a11af718374f0a8b11e7
                                                        • Instruction ID: 87c3b6a06604a91d4d2905ea065f7909b6fb9e5d1eeeb32c6475b2a2a9ec5518
                                                        • Opcode Fuzzy Hash: 08f15e549f1c2f343e7a4ee8702ca0bec1d8ac9b8986a11af718374f0a8b11e7
                                                        • Instruction Fuzzy Hash: EB01F5F2A43636EBD7315AA69E04B5B7EA8BF24764F011210FE84FB2D0D7228DD085D0
                                                        Function 00DEDA05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DEDA1A
                                                        • LeaveCriticalSection.KERNEL32(?), ref: 00DEDA5F
                                                        • SetEvent.KERNEL32(?,?,?,?), ref: 00DEDA73
                                                        Strings
                                                        • Failed to get state during job modification., xrefs: 00DEDA33
                                                        • Failure while sending progress during BITS job modification., xrefs: 00DEDA4E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterEventLeave
                                                        • String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
                                                        • API String ID: 3094578987-1258544340
                                                        • Opcode ID: 0b0f659dc8c4b3e382e9dc818edadc824c60df20d13acb139d38e95d2d726a07
                                                        • Instruction ID: 8212b8c11afc12bd0b9d8d8d788c57daf34f8f00c2a6a8eddb69ada46969d63c
                                                        • Opcode Fuzzy Hash: 0b0f659dc8c4b3e382e9dc818edadc824c60df20d13acb139d38e95d2d726a07
                                                        • Instruction Fuzzy Hash: 8501DE72A05664BFCB12EB56D848AAEB7A9FF64321B004215E805E3650DB31EA44C7E0
                                                        Function 00DEDC7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00DEDDEE), ref: 00DEDC92
                                                        • LeaveCriticalSection.KERNEL32(00000008,?,00DEDDEE), ref: 00DEDCD7
                                                        • SetEvent.KERNEL32(?,?,00DEDDEE), ref: 00DEDCEB
                                                        Strings
                                                        • Failure while sending progress., xrefs: 00DEDCC6
                                                        • Failed to get BITS job state., xrefs: 00DEDCAB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterEventLeave
                                                        • String ID: Failed to get BITS job state.$Failure while sending progress.
                                                        • API String ID: 3094578987-2876445054
                                                        • Opcode ID: 7a8d750cdae8c01b73ca77745d7a086497db8f7ed98acfbc9310b253e04d37e8
                                                        • Instruction ID: 7f88566abc0d0ca801f7de3bed1b0da8f02283b8adfa96fb19359c10028b1af9
                                                        • Opcode Fuzzy Hash: 7a8d750cdae8c01b73ca77745d7a086497db8f7ed98acfbc9310b253e04d37e8
                                                        • Instruction Fuzzy Hash: 2A012472A01725FFCB11AB47D84999ABBADFF08360B100155F904A3650DF71ED44C7E0
                                                        Function 00DED7E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,00DEDF52,?,?,?,?,?,?,00000000,00000000), ref: 00DED802
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00DEDF52,?,?,?,?,?,?,00000000,00000000), ref: 00DED80D
                                                        • GetLastError.KERNEL32(?,00DEDF52,?,?,?,?,?,?,00000000,00000000), ref: 00DED81A
                                                        Strings
                                                        • Failed to create BITS job complete event., xrefs: 00DED848
                                                        • bitsuser.cpp, xrefs: 00DED83E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateCriticalErrorEventInitializeLastSection
                                                        • String ID: Failed to create BITS job complete event.$bitsuser.cpp
                                                        • API String ID: 3069647169-3441864216
                                                        • Opcode ID: 267eab11a412adb97109dd7ffc9d877e4bcf25403fc9a6ea4d69d67a9a8fddef
                                                        • Instruction ID: 38c999bc9105bfef6766c7f4622b861c89ecd57fe04bcccd8d5f954775fbcad9
                                                        • Opcode Fuzzy Hash: 267eab11a412adb97109dd7ffc9d877e4bcf25403fc9a6ea4d69d67a9a8fddef
                                                        • Instruction Fuzzy Hash: 47015E76941632AFD315AB5AD845A8BBAA8FF09B60B014116FD08F7781EB719840CBF4
                                                        Function 00E068B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(?), ref: 00E0690F
                                                          • Part of subcall function 00E08713: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00E08820
                                                          • Part of subcall function 00E08713: GetLastError.KERNEL32 ref: 00E0882A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Time$ErrorFileFreeLastStringSystem
                                                        • String ID: Hr$`Dv$atomutil.cpp$clbcatq.dll
                                                        • API String ID: 211557998-3522982638
                                                        • Opcode ID: e4f82268f77f7f038f5db2733cf4a9f933d7849a3f1001a2e175873a1af7bb42
                                                        • Instruction ID: 9c8bb4c8fb25b9c0bf704e89f74b037629d87fd6ebac460d3a6f2783be62b28e
                                                        • Opcode Fuzzy Hash: e4f82268f77f7f038f5db2733cf4a9f933d7849a3f1001a2e175873a1af7bb42
                                                        • Instruction Fuzzy Hash: 01018FB190122AFFCF209FC5C84199AFBA8EB44765B60917AE504BB550C3715E60D6E0
                                                        Function 00DCD4A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00DD7040,000000B8,00000000,?,00000000,7694B390), ref: 00DCD4B7
                                                        • InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00DCD4C6
                                                        • LeaveCriticalSection.KERNEL32(000000D0,?,00DD7040,000000B8,00000000,?,00000000,7694B390), ref: 00DCD4DB
                                                        Strings
                                                        • user active cannot be changed because it was already in that state., xrefs: 00DCD4FE
                                                        • userexperience.cpp, xrefs: 00DCD4F4
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
                                                        • String ID: user active cannot be changed because it was already in that state.$userexperience.cpp
                                                        • API String ID: 3376869089-1544469594
                                                        • Opcode ID: 612d9d99fde8a5e72e3819273f1c279aa4aa54c92a13059028bdc90270695e91
                                                        • Instruction ID: 21af16cae5299f6299062a61898d4ca37d82ade5ea221a3449d18535c91d1b55
                                                        • Opcode Fuzzy Hash: 612d9d99fde8a5e72e3819273f1c279aa4aa54c92a13059028bdc90270695e91
                                                        • Instruction Fuzzy Hash: 5CF0AF72304309AFD7209EA6DC84E9773ADFB95761704442EF601E3690DA71E9498770
                                                        Function 00E01C88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00E01CB3
                                                        • GetLastError.KERNEL32(?,00DC49DA,00000001,?,?,00DC4551,?,?,?,?,00DC5466,?,?,?,?), ref: 00E01CC2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorLastProc
                                                        • String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
                                                        • API String ID: 199729137-398595594
                                                        • Opcode ID: 963c70b980b0922ede25c7ae2b307d774abc133df2c80bbc446369e0f65fdc26
                                                        • Instruction ID: b0c12cfff93abf85e4c1a70357746389621bb2f56cd5715f5d915da1ba8626de
                                                        • Opcode Fuzzy Hash: 963c70b980b0922ede25c7ae2b307d774abc133df2c80bbc446369e0f65fdc26
                                                        • Instruction Fuzzy Hash: 9701D676B8133697D33617E66C05B56A6849B007A6F0161A6BD00BF2D0D625DCC0C6E5
                                                        Function 00DF495D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00DF490E,00000000,?,00DF48AE,00000000,00E27F08,0000000C,00DF4A05,00000000,00000002), ref: 00DF497D
                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DF4990
                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,00DF490E,00000000,?,00DF48AE,00000000,00E27F08,0000000C,00DF4A05,00000000,00000002), ref: 00DF49B3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                        • String ID: CorExitProcess$mscoree.dll
                                                        • API String ID: 4061214504-1276376045
                                                        • Opcode ID: 3de56fb04b59101dcd269e9c08f3f12aac87f2c27140621eaf7033f4856faabf
                                                        • Instruction ID: 2a94b610dc5228a00f111a51a3b5763b8a8cad9a648f22f45a6afe6056a3cc7f
                                                        • Opcode Fuzzy Hash: 3de56fb04b59101dcd269e9c08f3f12aac87f2c27140621eaf7033f4856faabf
                                                        • Instruction Fuzzy Hash: A1F04F30A1121CBFCB119F91DC19BAEBFB9FB44711F0580A9F905B6150CBB54A84CAA1
                                                        Function 00DD9287 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32 ref: 00DD93C9
                                                          • Part of subcall function 00E056CF: GetLastError.KERNEL32(?,?,00DD933A,?,00000003,00000000,?), ref: 00E056EE
                                                        Strings
                                                        • Failed to find expected public key in certificate chain., xrefs: 00DD938A
                                                        • Failed to read certificate thumbprint., xrefs: 00DD93BD
                                                        • Failed to get certificate public key identifier., xrefs: 00DD93F7
                                                        • cache.cpp, xrefs: 00DD93ED
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast
                                                        • String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
                                                        • API String ID: 1452528299-3408201827
                                                        • Opcode ID: 117c4d6f70c1b7a9a8b67c231f7861c7f2d3276c05ff574a168b74da3bed74b1
                                                        • Instruction ID: 98789e8869001960202b1780abf1f5cbc812677797685497cb664c36c2f3b281
                                                        • Opcode Fuzzy Hash: 117c4d6f70c1b7a9a8b67c231f7861c7f2d3276c05ff574a168b74da3bed74b1
                                                        • Instruction Fuzzy Hash: 08414D72A00219AFDB10EBA9C851EAEF7B8BB08710F05412AE905F7391D775ED40CBB0
                                                        Function 00DC21AC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC21F2
                                                        • GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC21FE
                                                          • Part of subcall function 00DC3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BDB
                                                          • Part of subcall function 00DC3BD3: HeapSize.KERNEL32(00000000,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BE2
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                        • String ID: strutil.cpp
                                                        • API String ID: 3662877508-3612885251
                                                        • Opcode ID: 74fae1cbb0898ca37b33e7099832865afe1f42a05e6ff8f701fc1da87992caba
                                                        • Instruction ID: f94e6b2b4a99cfbfcd9c157c614c5b7eac23bcec9a05044c9922f12a286cf8f5
                                                        • Opcode Fuzzy Hash: 74fae1cbb0898ca37b33e7099832865afe1f42a05e6ff8f701fc1da87992caba
                                                        • Instruction Fuzzy Hash: D831F732601227ABD7218EA5CC44F7BBA99AF05774B15432CFD55AF290E771CC4086F8
                                                        Function 00E094FD Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00E095D5
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00E09610
                                                        • RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00E0962C
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00E09639
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00E09646
                                                          • Part of subcall function 00E00FD5: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00E095C2,00000001), ref: 00E00FED
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close$InfoOpenQuery
                                                        • String ID:
                                                        • API String ID: 796878624-0
                                                        • Opcode ID: c809bfa21d4409365a6ea9c0ce3fcb45a923235c66ea8debff5aebd103cd7baf
                                                        • Instruction ID: 977ee343206db10c9441283778c450dd40e576e5e4a39457e32c2ba49760f342
                                                        • Opcode Fuzzy Hash: c809bfa21d4409365a6ea9c0ce3fcb45a923235c66ea8debff5aebd103cd7baf
                                                        • Instruction Fuzzy Hash: D7418A72C0062DFFCF22AF94DD819ADFBB9EF14714F1151BAE91076162C7324E80AA90
                                                        Function 00DC8A07 Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00DC8BC8,00DC972D,?,00DC972D,?,?,00DC972D,?,?), ref: 00DC8A27
                                                        • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00DC8BC8,00DC972D,?,00DC972D,?,?,00DC972D,?,?), ref: 00DC8A2F
                                                        • CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00DC8BC8,00DC972D,?,00DC972D,?), ref: 00DC8A7E
                                                        • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00DC8BC8,00DC972D,?,00DC972D,?), ref: 00DC8AE0
                                                        • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00DC8BC8,00DC972D,?,00DC972D,?), ref: 00DC8B0D
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString$lstrlen
                                                        • String ID:
                                                        • API String ID: 1657112622-0
                                                        • Opcode ID: 5edf67bfdf10adae19d9b1c82e7f16bb8c0b884230a5c98dbaf4f67019bbab5b
                                                        • Instruction ID: 0586520f493ef27188ffb3b333d5c185611f396bafe5a540f77cd956dfc7e388
                                                        • Opcode Fuzzy Hash: 5edf67bfdf10adae19d9b1c82e7f16bb8c0b884230a5c98dbaf4f67019bbab5b
                                                        • Instruction Fuzzy Hash: 42314F72A0110ABFCF218E59CC85FAE3F6AFB48390F15441AF959D7210CA719D90EBB0
                                                        Function 00DC74B7 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00DC53BD,WixBundleOriginalSource,?,?,00DDA623,840F01E8,WixBundleOriginalSource,?,00E2AA90,?,00000000,00DC5445,00000001,?,?,00DC5445), ref: 00DC74C3
                                                        • LeaveCriticalSection.KERNEL32(00DC53BD,00DC53BD,00000000,00000000,?,?,00DDA623,840F01E8,WixBundleOriginalSource,?,00E2AA90,?,00000000,00DC5445,00000001,?), ref: 00DC752A
                                                        Strings
                                                        • WixBundleOriginalSource, xrefs: 00DC74BF
                                                        • Failed to get value as string for variable: %ls, xrefs: 00DC7519
                                                        • Failed to get value of variable: %ls, xrefs: 00DC74FD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
                                                        • API String ID: 3168844106-30613933
                                                        • Opcode ID: 94ef0ca78f57b0a5760898868dc640d41d7b9615e49c7971978885b51f2df709
                                                        • Instruction ID: a10e7e37238e1899c2fd5ba7d37583b3fcc6314d771a6230a68975a1b4b8d004
                                                        • Opcode Fuzzy Hash: 94ef0ca78f57b0a5760898868dc640d41d7b9615e49c7971978885b51f2df709
                                                        • Instruction Fuzzy Hash: 01019A3295812AEFCF229F50CC05F9E7E68EF00361F104168FD04BB221C3369A919BE0
                                                        Function 00DED152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CloseHandle.KERNEL32(?,00000000,?,00000000,?,00DED148,00000000), ref: 00DED16D
                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00DED148,00000000), ref: 00DED179
                                                        • CloseHandle.KERNEL32(00E0B518,00000000,?,00000000,?,00DED148,00000000), ref: 00DED186
                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00DED148,00000000), ref: 00DED193
                                                        • UnmapViewOfFile.KERNEL32(00E0B4E8,00000000,?,00DED148,00000000), ref: 00DED1A2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseHandle$FileUnmapView
                                                        • String ID:
                                                        • API String ID: 260491571-0
                                                        • Opcode ID: 10b9b2b571d560e3061bfc76e7f7dea318808a193e95fee289e5f3dbe4068475
                                                        • Instruction ID: 42ec8ec93b3636f1f48465f355c24db53add72a4624d604c363872645aa9a960
                                                        • Opcode Fuzzy Hash: 10b9b2b571d560e3061bfc76e7f7dea318808a193e95fee289e5f3dbe4068475
                                                        • Instruction Fuzzy Hash: BE01FB76400B55DFCB316F66D880816F7EAFF50711319C93EE1A652530C771A890CF60
                                                        Function 00E036CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(000002C0), ref: 00E036E6
                                                        • SysAllocString.OLEAUT32(?), ref: 00E036F6
                                                        • VariantClear.OLEAUT32(?), ref: 00E037D5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Variant$AllocClearInitString
                                                        • String ID: xmlutil.cpp
                                                        • API String ID: 2213243845-1270936966
                                                        • Opcode ID: 000b39021044a346c3b76ae585fd32324b46f47c4319ba331d5f0624e94a2984
                                                        • Instruction ID: 43349a6d61ad4a5c661dd231ed561bd318c047cb71256379c247291dfde31013
                                                        • Opcode Fuzzy Hash: 000b39021044a346c3b76ae585fd32324b46f47c4319ba331d5f0624e94a2984
                                                        • Instruction Fuzzy Hash: 4F4165F5A00225ABCB119FB5C888EAFBBBCAF05711F1951A5FC01FB241D635DE408BA0
                                                        Function 00E00E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00DE8E1B), ref: 00E00EAA
                                                        • RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DE8E1B,00000000), ref: 00E00EC8
                                                        • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00DE8E1B,00000000,00000000,00000000), ref: 00E00F1E
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Enum$InfoQuery
                                                        • String ID: regutil.cpp
                                                        • API String ID: 73471667-955085611
                                                        • Opcode ID: 57b599215e22123aa284811b7a8cb5144fd89452295310552eb689b9aaf2929a
                                                        • Instruction ID: 9a6b115504981517e78bed318faf8c6c83ef3096f7b38286bd633f4ac418df0a
                                                        • Opcode Fuzzy Hash: 57b599215e22123aa284811b7a8cb5144fd89452295310552eb689b9aaf2929a
                                                        • Instruction Fuzzy Hash: B531BE76A0112ABFEB318B84CC80FAFB76CEF04764F150065BD04BB290D7718E81A6B0
                                                        Function 00DE8B17 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00DE8E57,00000000,00000000), ref: 00DE8BD4
                                                        Strings
                                                        • Failed to open uninstall key for potential related bundle: %ls, xrefs: 00DE8B43
                                                        • Failed to ensure there is space for related bundles., xrefs: 00DE8B87
                                                        • Failed to initialize package from related bundle id: %ls, xrefs: 00DE8BBA
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseOpen
                                                        • String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
                                                        • API String ID: 47109696-1717420724
                                                        • Opcode ID: e7a31e3c1cc21039f0a25b27e97fe50c481bb1d58cf05b849242382c085bbc2f
                                                        • Instruction ID: 570e8dee838a120ee7dd95b3689437d3a4a08ce90de739598f9359e005c82423
                                                        • Opcode Fuzzy Hash: e7a31e3c1cc21039f0a25b27e97fe50c481bb1d58cf05b849242382c085bbc2f
                                                        • Instruction Fuzzy Hash: B521B0B294065AFBDF12AE81CC06FEEBB78EF04311F104055F904B61A0DB719A60FBA0
                                                        Function 00DC3B15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,00DC1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DC13B8), ref: 00DC3B33
                                                        • HeapReAlloc.KERNEL32(00000000,?,00DC1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00DC13B8,000001C7,00000100,?,80004005,00000000), ref: 00DC3B3A
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                          • Part of subcall function 00DC3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BDB
                                                          • Part of subcall function 00DC3BD3: HeapSize.KERNEL32(00000000,?,00DC21CC,000001C7,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3BE2
                                                        • _memcpy_s.LIBCMT ref: 00DC3B86
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$Process$AllocAllocateSize_memcpy_s
                                                        • String ID: memutil.cpp
                                                        • API String ID: 3406509257-2429405624
                                                        • Opcode ID: df03d7df3e792dea058daff11c069ee4e00072ddedc84e45b0cdb9b17f775c47
                                                        • Instruction ID: 60069a440ef91869df9ccf390da3388a16b66c5340d30e26ff62ffeec091646f
                                                        • Opcode Fuzzy Hash: df03d7df3e792dea058daff11c069ee4e00072ddedc84e45b0cdb9b17f775c47
                                                        • Instruction Fuzzy Hash: F611903150561BABCB226E68CC48F6F3A5AEF40764B198218F8159B262D632CF6496F0
                                                        Function 00E0894D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32 ref: 00E08991
                                                        • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E089B9
                                                        • GetLastError.KERNEL32 ref: 00E089C3
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastTime$FileSystem
                                                        • String ID: inetutil.cpp
                                                        • API String ID: 1528435940-2900720265
                                                        • Opcode ID: 40eef65192eec5cc77972e054a2146615460fc5aafffb1df9f04ebfd528ab993
                                                        • Instruction ID: 24898f02c48d3a502723aac43d954330d80caa48e7a806fc463508b1f4de393c
                                                        • Opcode Fuzzy Hash: 40eef65192eec5cc77972e054a2146615460fc5aafffb1df9f04ebfd528ab993
                                                        • Instruction Fuzzy Hash: 5C11EC3390113AABD320ABA6CD05BBFBBA8EF44750F410125AE84F7240DA309D4486F2
                                                        Function 00DD3AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00DD3FB5,feclient.dll,?,00000000,?,?,?,00DC4B12), ref: 00DD3B42
                                                          • Part of subcall function 00E010B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00E0112B
                                                          • Part of subcall function 00E010B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00E01163
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$CloseOpen
                                                        • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                        • API String ID: 1586453840-3596319545
                                                        • Opcode ID: ce2c0cb7905d58f91f0e1a6283b703b605469649a2db9cf0faf8758cd183b6a9
                                                        • Instruction ID: 912a7dd9d1abaef69d2d5001a36f80660fb2aecfc27e34cbd6e74e816553d747
                                                        • Opcode Fuzzy Hash: ce2c0cb7905d58f91f0e1a6283b703b605469649a2db9cf0faf8758cd183b6a9
                                                        • Instruction Fuzzy Hash: F311B237B40308BBDB21DF95DC82EBABBB8EB14700F4500A7E500AB291D6719F81D761
                                                        Function 00E00764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(00DE12CF,00000000,00000000,?,?,?,00E00013,00DE12CF,00DE12CF,?,00000000,0000FDE9,?,00DE12CF,8007139F,Invalid operation for this state.), ref: 00E00776
                                                        • WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,00E00013,00DE12CF,00DE12CF,?,00000000,0000FDE9,?,00DE12CF,8007139F), ref: 00E007B2
                                                        • GetLastError.KERNEL32(?,?,00E00013,00DE12CF,00DE12CF,?,00000000,0000FDE9,?,00DE12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00E007BC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastWritelstrlen
                                                        • String ID: logutil.cpp
                                                        • API String ID: 606256338-3545173039
                                                        • Opcode ID: 7809dfe4de39bf4d15adb7989f2abf9969cee52df715e734579b6a2a8006c381
                                                        • Instruction ID: 349c7d65b0d4efae7df82e9df5031a9ccfd70c3fabb0df9db0db18278d51e867
                                                        • Opcode Fuzzy Hash: 7809dfe4de39bf4d15adb7989f2abf9969cee52df715e734579b6a2a8006c381
                                                        • Instruction Fuzzy Hash: 4811CA72A41225EBC324AA669D44FBBBB6CFB45760F151226FD00F7280D775AD40C9E0
                                                        Function 00DC120A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00DC523F,00000000,?), ref: 00DC1248
                                                        • GetLastError.KERNEL32(?,?,?,00DC523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00DC1252
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ArgvCommandErrorLastLine
                                                        • String ID: apputil.cpp$ignored
                                                        • API String ID: 3459693003-568828354
                                                        • Opcode ID: 005458df70e0e4b8d6b515dec7c54d0dc905de81d4ebbd6f02141590ed82f189
                                                        • Instruction ID: cad742630dbb361ddbc645e92ea57f10a767eb9f1ddfb0d28253569060e77c9d
                                                        • Opcode Fuzzy Hash: 005458df70e0e4b8d6b515dec7c54d0dc905de81d4ebbd6f02141590ed82f189
                                                        • Instruction Fuzzy Hash: 67115E7A90123AEBCB21DB99D806E9EFBACEF45750F110199FD04E7251D631DE00DAB4
                                                        Function 00DED1B3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,00DED3EE,00000000,00000000,00000000,?), ref: 00DED1C3
                                                        • ReleaseMutex.KERNEL32(?,?,00DED3EE,00000000,00000000,00000000,?), ref: 00DED24A
                                                          • Part of subcall function 00DC394F: GetProcessHeap.KERNEL32(?,000001C7,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3960
                                                          • Part of subcall function 00DC394F: RtlAllocateHeap.NTDLL(00000000,?,00DC2274,000001C7,00000001,80004005,8007139F,?,?,00E00267,8007139F,?,00000000,00000000,8007139F), ref: 00DC3967
                                                        Strings
                                                        • NetFxChainer.cpp, xrefs: 00DED208
                                                        • Failed to allocate memory for message data, xrefs: 00DED212
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
                                                        • String ID: Failed to allocate memory for message data$NetFxChainer.cpp
                                                        • API String ID: 2993511968-1624333943
                                                        • Opcode ID: be8eb810ea193589296d458275d007a7252ff30f31c789a081600b9d22f2884e
                                                        • Instruction ID: 55aeee95bcded8191be5cfbe3fd75174e9d5059194fe2a1f79d3a7c5352bf3d7
                                                        • Opcode Fuzzy Hash: be8eb810ea193589296d458275d007a7252ff30f31c789a081600b9d22f2884e
                                                        • Instruction Fuzzy Hash: DB118FB1200215AFCB159F65E885E59B7F5FF49720B144168F9149B3A1C771A810CBE4
                                                        Function 00DC1F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • FormatMessageW.KERNEL32(00DC428F,00DC548E,?,00000000,00000000,00000000,?,80070656,?,?,?,00DDE75C,00000000,00DC548E,00000000,80070656), ref: 00DC1F9A
                                                        • GetLastError.KERNEL32(?,?,?,00DDE75C,00000000,00DC548E,00000000,80070656,?,?,00DD40BF,00DC548E,?,80070656,00000001,crypt32.dll), ref: 00DC1FA7
                                                        • LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00DDE75C,00000000,00DC548E,00000000,80070656,?,?,00DD40BF,00DC548E), ref: 00DC1FEE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFormatFreeLastLocalMessage
                                                        • String ID: strutil.cpp
                                                        • API String ID: 1365068426-3612885251
                                                        • Opcode ID: ca41870a28b9c437d311f12a3bfc6843c3f7808ad189ecf9807bdf0355481f4e
                                                        • Instruction ID: 8c3a9c293bbc00997de1c8c99c2baa4b8fbc5fd6e0b3c7ab82608d97ebe0cd16
                                                        • Opcode Fuzzy Hash: ca41870a28b9c437d311f12a3bfc6843c3f7808ad189ecf9807bdf0355481f4e
                                                        • Instruction Fuzzy Hash: A70157BB90012AFBDB219E95CC09EAABAACEF05710F044169BD00F7250E7318E009AE0
                                                        Function 00DD0721 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00DD0791
                                                        Strings
                                                        • Failed to open registration key., xrefs: 00DD0748
                                                        • Failed to update name and publisher., xrefs: 00DD077B
                                                        • Failed to update resume mode., xrefs: 00DD0762
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseOpen
                                                        • String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
                                                        • API String ID: 47109696-1865096027
                                                        • Opcode ID: 23ec59222769107dd187d8f114532d5ae1d32c4285d6d09aeba6f6ab670754b9
                                                        • Instruction ID: 76c244df1fff274d47170904bfbc374b7c1dcb5567ad3c98d36a3185c24bb514
                                                        • Opcode Fuzzy Hash: 23ec59222769107dd187d8f114532d5ae1d32c4285d6d09aeba6f6ab670754b9
                                                        • Instruction Fuzzy Hash: 9A018832A40229FBCB125694DC41FEEBA69EF40B21F140156F500BA250D771BE50ABE4
                                                        Function 00E04DB3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00E0B500,40000000,00000001,00000000,00000002,00000080,00000000,00DD04BF,00000000,?,00DCF4F4,?,00000080,00E0B500,00000000), ref: 00E04DCB
                                                        • GetLastError.KERNEL32(?,00DCF4F4,?,00000080,00E0B500,00000000,?,00DD04BF,?,00000094,?,?,?,?,?,00000000), ref: 00E04DD8
                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00DCF4F4,?,00DCF4F4,?,00000080,00E0B500,00000000,?,00DD04BF,?,00000094), ref: 00E04E2C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorFileHandleLast
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 2528220319-2967768451
                                                        • Opcode ID: d6bf3fbd7207fd4b31358ee5aeb76c338e4137a0da956bc7b47c92632df75ed0
                                                        • Instruction ID: 8098b6dec45182615cebe050f1851f91e65527fd9d5e7b2bbfcc7412f28147c0
                                                        • Opcode Fuzzy Hash: d6bf3fbd7207fd4b31358ee5aeb76c338e4137a0da956bc7b47c92632df75ed0
                                                        • Instruction Fuzzy Hash: A701D4B3641125ABD7225A69DE09F5F3A54BB41B71F015310FF20BF1D0D7718C8292E0
                                                        Function 00E0497A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00DE8C76,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00E049AE
                                                        • GetLastError.KERNEL32(?,00DE8C76,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,userVersion,000002C0,000000B0), ref: 00E049BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorFileLast
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 1214770103-2967768451
                                                        • Opcode ID: 662990b7138051ce778acf93ae2f9828eb6fe63e4fd93a51aee293f4c5ccf7b2
                                                        • Instruction ID: 5d020f6616bb48707d97ffd63b75b5f4fabb68ea8f2c50ee3a112f25bfb4e5ca
                                                        • Opcode Fuzzy Hash: 662990b7138051ce778acf93ae2f9828eb6fe63e4fd93a51aee293f4c5ccf7b2
                                                        • Instruction Fuzzy Hash: 7A01DBF3680136F7D32226956D09F6B2658AB80B60F115221FF91BF1D0D7659D8091E0
                                                        Function 00DE6BEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49serviceCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ControlService.ADVAPI32(00DE6AFD,00000001,?,00000001,00000000,?,?,?,?,?,?,00DE6AFD,00000000), ref: 00DE6C13
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00DE6AFD,00000000), ref: 00DE6C1D
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ControlErrorLastService
                                                        • String ID: Failed to stop wusa service.$msuuser.cpp
                                                        • API String ID: 4114567744-2259829683
                                                        • Opcode ID: c2706d2cba4a53459734c36a2fe79997cbceaa3488062bc8993ce8480bb60935
                                                        • Instruction ID: b688593965e0947479d8ce572afd88e872f113b796775eea8da202814d79e000
                                                        • Opcode Fuzzy Hash: c2706d2cba4a53459734c36a2fe79997cbceaa3488062bc8993ce8480bb60935
                                                        • Instruction Fuzzy Hash: B4012073A452396BD720EB669C05F9F7BA4EF08B60F110025FD00BB180DA259C4145F4
                                                        Function 00E039AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysAllocString.OLEAUT32(?), ref: 00E039F4
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E03A27
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$AllocFree
                                                        • String ID: `Dv$xmlutil.cpp
                                                        • API String ID: 344208780-2876128059
                                                        • Opcode ID: 9214c5642ce018a6c1d24c9ce74dbf3d2ef7454e0e0586f45707c950e498ce0a
                                                        • Instruction ID: 97898933a805a8ebd76ffca1dc2a7d0d013c3996b17ed27660d88342fbd79f09
                                                        • Opcode Fuzzy Hash: 9214c5642ce018a6c1d24c9ce74dbf3d2ef7454e0e0586f45707c950e498ce0a
                                                        • Instruction Fuzzy Hash: 9D01D635744215BBD7215AA99C09FBB36ECEF91B64F10552AFC44F7380C6B5CE8086E0
                                                        Function 00E03929 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysAllocString.OLEAUT32(?), ref: 00E0396E
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E039A1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$AllocFree
                                                        • String ID: `Dv$xmlutil.cpp
                                                        • API String ID: 344208780-2876128059
                                                        • Opcode ID: 186b41148ac174328a5d848f0a3bb72cfcf8e8006c533f5b54beee2e12ce90e2
                                                        • Instruction ID: 32e2d794ed39efef7bba6e65615965ca05d998cd85ef05a22cc4c33c6bd7c7a9
                                                        • Opcode Fuzzy Hash: 186b41148ac174328a5d848f0a3bb72cfcf8e8006c533f5b54beee2e12ce90e2
                                                        • Instruction Fuzzy Hash: 1601A231645216ABD7211AA99C05FBB36DCEF81B64F605539FD40F7380C6B4CD8096E1
                                                        Function 00DDECC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00DDECED
                                                        • GetLastError.KERNEL32 ref: 00DDECF7
                                                        Strings
                                                        • Failed to post elevate message., xrefs: 00DDED25
                                                        • userForApplication.cpp, xrefs: 00DDED1B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessagePostThread
                                                        • String ID: userForApplication.cpp$Failed to post elevate message.
                                                        • API String ID: 2609174426-4098423239
                                                        • Opcode ID: 06ab7bf10c766eb4bd8b20ec440c84c20b9c5cb826ba406c66831d90bc22a1c6
                                                        • Instruction ID: e338fa6d8c75a80c560f3b6e40baa64e06afb4bfa174486a8dfe7338750d1e31
                                                        • Opcode Fuzzy Hash: 06ab7bf10c766eb4bd8b20ec440c84c20b9c5cb826ba406c66831d90bc22a1c6
                                                        • Instruction Fuzzy Hash: C2F0FC33640331ABC7206A995C09B977794BF04B70B254125FE14BF2D2DB65CC4182E0
                                                        Function 00DCD8DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00DCD903
                                                        • FreeLibrary.KERNEL32(?,?,00DC48D7,00000000,?,?,00DC548E,?,?), ref: 00DCD912
                                                        • GetLastError.KERNEL32(?,00DC48D7,00000000,?,?,00DC548E,?,?), ref: 00DCD91C
                                                        Strings
                                                        • BootstrapperApplicationDestroy, xrefs: 00DCD8FB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorFreeLastLibraryProc
                                                        • String ID: BootstrapperApplicationDestroy
                                                        • API String ID: 1144718084-3186005537
                                                        • Opcode ID: 9ac179d51a16e4566ed300ff42af0ecce0dac5255c9b85db64779a2ec9929ded
                                                        • Instruction ID: 190441a5974050190b6cbbcf043421019b5611facee45415cd210701d86f73a2
                                                        • Opcode Fuzzy Hash: 9ac179d51a16e4566ed300ff42af0ecce0dac5255c9b85db64779a2ec9929ded
                                                        • Instruction Fuzzy Hash: EDF04F36600627ABC3204F6ADC04F2AF7A5BF04B62B058239A825E7520DB71EC508FE0
                                                        Function 00E031EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysAllocString.OLEAUT32(?), ref: 00E03200
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E03230
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$AllocFree
                                                        • String ID: `Dv$xmlutil.cpp
                                                        • API String ID: 344208780-2876128059
                                                        • Opcode ID: bd9bbd2f74aa42ab169dd2aa9269896d0510c90006420906a325d240c15a9f2d
                                                        • Instruction ID: e84e466e94b100a07e7719b6c0759bd9e673d9f16f518964c30c7dc4424a3260
                                                        • Opcode Fuzzy Hash: bd9bbd2f74aa42ab169dd2aa9269896d0510c90006420906a325d240c15a9f2d
                                                        • Instruction Fuzzy Hash: 44F0B431101654EBC7310F94AC08FABB7ACFF40B60F245029FC0477260C7758E9096E0
                                                        Function 00E03498 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysAllocString.OLEAUT32(?), ref: 00E034AD
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E034DD
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: String$AllocFree
                                                        • String ID: `Dv$xmlutil.cpp
                                                        • API String ID: 344208780-2876128059
                                                        • Opcode ID: d74d6d4b794f9404799c68b903adbe6b72bc54c7d834baa36df60f520d561e3d
                                                        • Instruction ID: 5722c90911c17faf8e5cbba5a9731409be82bfa9c53fb6eb1999f4e954793eda
                                                        • Opcode Fuzzy Hash: d74d6d4b794f9404799c68b903adbe6b72bc54c7d834baa36df60f520d561e3d
                                                        • Instruction Fuzzy Hash: DBF0B435241215ABC7331E55AC08E9B77ACEF41B65F20411BFC147B250C776DE8096E0
                                                        Function 00DDF2D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00DDF2EE
                                                        • GetLastError.KERNEL32 ref: 00DDF2F8
                                                        Strings
                                                        • Failed to post plan message., xrefs: 00DDF326
                                                        • userForApplication.cpp, xrefs: 00DDF31C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessagePostThread
                                                        • String ID: userForApplication.cpp$Failed to post plan message.
                                                        • API String ID: 2609174426-2952114608
                                                        • Opcode ID: de4bf7922c8ec913a7c82b511f39feec58662b72e387d431e6552bcb841f7ade
                                                        • Instruction ID: 12bbc774e52006d2d4fb480f391a811f72205a176b384b4aaf100b9c445adcda
                                                        • Opcode Fuzzy Hash: de4bf7922c8ec913a7c82b511f39feec58662b72e387d431e6552bcb841f7ade
                                                        • Instruction Fuzzy Hash: 18F0A7336412316BD6312B965C09E8B7F94EF04B60B024025FD54BB292D661DC4081F0
                                                        Function 00DDF3E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00DDF3FC
                                                        • GetLastError.KERNEL32 ref: 00DDF406
                                                        Strings
                                                        • Failed to post shutdown message., xrefs: 00DDF434
                                                        • userForApplication.cpp, xrefs: 00DDF42A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessagePostThread
                                                        • String ID: userForApplication.cpp$Failed to post shutdown message.
                                                        • API String ID: 2609174426-188808143
                                                        • Opcode ID: 4c7501409eeb385d9dba059d7c3a9e43c1cd97ad2378c718e98daacd2d66e217
                                                        • Instruction ID: 49f284fe0fc8fef74b07835a7f5c62c73fca80066afeb680450a463927a2e7be
                                                        • Opcode Fuzzy Hash: 4c7501409eeb385d9dba059d7c3a9e43c1cd97ad2378c718e98daacd2d66e217
                                                        • Instruction Fuzzy Hash: D3F0A033A412357BC6311B96AC0AF8B7B98FF04B60B024036BE14BB292E665DC4086F0
                                                        Function 00DE07B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEvent.KERNEL32(00E0B478,00000000,?,00DE1717,?,00000000,?,00DCC287,?,00DC5405,?,00DD75A5,?,?,00DC5405,?), ref: 00DE07BF
                                                        • GetLastError.KERNEL32(?,00DE1717,?,00000000,?,00DCC287,?,00DC5405,?,00DD75A5,?,?,00DC5405,?,00DC5445,00000001), ref: 00DE07C9
                                                        Strings
                                                        • Failed to set begin operation event., xrefs: 00DE07F7
                                                        • cabextract.cpp, xrefs: 00DE07ED
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorEventLast
                                                        • String ID: Failed to set begin operation event.$cabextract.cpp
                                                        • API String ID: 3848097054-4159625223
                                                        • Opcode ID: d3194c63ff35711c862b86c89eb06711ded94316b2f969e86709d32b3a0e0bf5
                                                        • Instruction ID: f5ba8495f90f07d7e3b8c63bf9eb96f4e47b15c0637ee0e7254c16c98a3f3100
                                                        • Opcode Fuzzy Hash: d3194c63ff35711c862b86c89eb06711ded94316b2f969e86709d32b3a0e0bf5
                                                        • Instruction Fuzzy Hash: 70F0EC3764267167D22136975D05B9F7A84EF04B71B154135FE01BB240E651ACC0C6F5
                                                        Function 00DDEBCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00DDEBE0
                                                        • GetLastError.KERNEL32 ref: 00DDEBEA
                                                        Strings
                                                        • Failed to post apply message., xrefs: 00DDEC18
                                                        • userForApplication.cpp, xrefs: 00DDEC0E
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessagePostThread
                                                        • String ID: userForApplication.cpp$Failed to post apply message.
                                                        • API String ID: 2609174426-1304321051
                                                        • Opcode ID: 42c57a19046ac4df526429c83250bcff95ac640f012bc41839ea377029206362
                                                        • Instruction ID: 875762763ac57d7f000bcf85ad364a0df1488e32d77063883ab28fc649a6e7e8
                                                        • Opcode Fuzzy Hash: 42c57a19046ac4df526429c83250bcff95ac640f012bc41839ea377029206362
                                                        • Instruction Fuzzy Hash: ACF03733A912357BD631269A9C0DE9BBF94EF04B70B064015FE18BF291D665DC4086F5
                                                        Function 00DDEC5C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00DDEC71
                                                        • GetLastError.KERNEL32 ref: 00DDEC7B
                                                        Strings
                                                        • userForApplication.cpp, xrefs: 00DDEC9F
                                                        • Failed to post detect message., xrefs: 00DDECA9
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastMessagePostThread
                                                        • String ID: userForApplication.cpp$Failed to post detect message.
                                                        • API String ID: 2609174426-598219917
                                                        • Opcode ID: daf4f01827923fcc59d975c6b8965e8b8b7177a35fcc8cb8956d52a308f8d0de
                                                        • Instruction ID: 0f9698a870fb4e715925d64e2d10275b13ddb5446ae8cf361e3e825de623dfa0
                                                        • Opcode Fuzzy Hash: daf4f01827923fcc59d975c6b8965e8b8b7177a35fcc8cb8956d52a308f8d0de
                                                        • Instruction Fuzzy Hash: 61F0A7336513316BD631669A5C09F877F94FF04B71B124011BD18BF291D661DC40C1F4
                                                        Function 00DF6B76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: __alldvrm$_strrchr
                                                        • String ID:
                                                        • API String ID: 1036877536-0
                                                        • Opcode ID: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                        • Instruction ID: e8822a6a11670465c8776a448339a71f7787b1fe0567441f2d01d7a9285d7588
                                                        • Opcode Fuzzy Hash: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                        • Instruction Fuzzy Hash: 3BA12576A0038A9FDB218F28C8817BABFE5EF51310F1AC16DE6859B682C634CD41C771
                                                        Function 00E05EC5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen
                                                        • String ID: dlutil.cpp
                                                        • API String ID: 1659193697-2067379296
                                                        • Opcode ID: 953faddf16a3957bb5af393dcd9495880954ba1d017dd7e565068777e4a2f65b
                                                        • Instruction ID: e9128d9e607b762970e89f3ed7a531a26aae0534aa2b7105c5e1ac7fd04e9b8e
                                                        • Opcode Fuzzy Hash: 953faddf16a3957bb5af393dcd9495880954ba1d017dd7e565068777e4a2f65b
                                                        • Instruction Fuzzy Hash: B951B372A0162AEFDB219FE58C40AAFBBB9EF88714F155114F900B7290D735DD918FA0
                                                        Function 00DF922B Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • MultiByteToWideChar.KERNEL32(?,00000000,ECE85006,00DF2444,00000000,00000000,00DF3479,?,00DF3479,?,00000001,00DF2444,ECE85006,00000001,00DF3479,00DF3479), ref: 00DF9278
                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DF9301
                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00DF9313
                                                        • __freea.LIBCMT ref: 00DF931C
                                                          • Part of subcall function 00DF521A: HeapAlloc.KERNEL32(00000000,?,?,?,00DF1F87,?,0000015D,?,?,?,?,00DF33E0,000000FF,00000000,?,?), ref: 00DF524C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ByteCharMultiWide$AllocHeapStringType__freea
                                                        • String ID:
                                                        • API String ID: 573072132-0
                                                        • Opcode ID: ca2d397cf768876f917bbff19198d100d7be765fe992a1342f4bd4612d41f975
                                                        • Instruction ID: c28e1f0f348ac6d71bf5f95c86ca6767c75619a488b72a9113ed857f8e1de2bd
                                                        • Opcode Fuzzy Hash: ca2d397cf768876f917bbff19198d100d7be765fe992a1342f4bd4612d41f975
                                                        • Instruction Fuzzy Hash: 1B31AE32E0020AAFDB249F65CC91EBEBBA5EB40310B0A8128FD04D7195E735CD95CBA0
                                                        Function 00DC4FA4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CloseHandle.KERNEL32(?,?,?,00000000,?,00DC5552,?,?,?,?,?,?), ref: 00DC4FFE
                                                        • DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,00DC5552,?,?,?,?,?,?), ref: 00DC5012
                                                        • TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00DC5552,?,?), ref: 00DC5101
                                                        • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00DC5552,?,?), ref: 00DC5108
                                                          • Part of subcall function 00DC1161: LocalFree.KERNEL32(?,?,00DC4FBB,?,00000000,?,00DC5552,?,?,?,?,?,?), ref: 00DC116B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalDeleteFreeSection$CloseHandleLocal
                                                        • String ID:
                                                        • API String ID: 3671900028-0
                                                        • Opcode ID: 4c5bf97d72c0c2949c5f729dbaf9ddfe3446b765051829dc18757d3448ad0040
                                                        • Instruction ID: 7463de05f531ad3961cdc999f3876a36d092b9af1a5fb865abaf6e0a1942738b
                                                        • Opcode Fuzzy Hash: 4c5bf97d72c0c2949c5f729dbaf9ddfe3446b765051829dc18757d3448ad0040
                                                        • Instruction Fuzzy Hash: 9B41DBB1500B06ABDA30EBB1D889F9B73ECAF04340F44092DB69AD3091EB35F5859B74
                                                        Function 00E06067 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,00E05FD0,00000000,00000000,00000001), ref: 00E060DF
                                                        • GetLastError.KERNEL32(?,?,00E05FD0,00000000,00000000,00000001), ref: 00E06130
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast
                                                        • String ID: 8j$dlutil.cpp
                                                        • API String ID: 1452528299-3597604981
                                                        • Opcode ID: 972ca34911764df77a83dee8854c923ef39a261f296565d94ea8556af89c5589
                                                        • Instruction ID: 858b9afdd42ad63fe9a03d34cb47f466924fd11aefed4f6ba2225f86cab61882
                                                        • Opcode Fuzzy Hash: 972ca34911764df77a83dee8854c923ef39a261f296565d94ea8556af89c5589
                                                        • Instruction Fuzzy Hash: DB31073694122ABBCB324F959C44F9B7AB8EF40B64F160224FD04BB281D731CD9096F0
                                                        Function 00DC4C86 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68COMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00DCF96C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00DC4CA5,?,?,00000001), ref: 00DCF9BC
                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00DC4D0C
                                                        Strings
                                                        • Unable to get resume command line from the registry, xrefs: 00DC4CAB
                                                        • Failed to get current process path., xrefs: 00DC4CCA
                                                        • Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00DC4CF6
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close$Handle
                                                        • String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
                                                        • API String ID: 187904097-642631345
                                                        • Opcode ID: a73dedda99e91d36e1b835633c6bd73f2beef15683671c8a49ac8f73c8af6e19
                                                        • Instruction ID: ba2c732946ec88424c63032ed639c76183f32b53ffc739b7e378582eb1315add
                                                        • Opcode Fuzzy Hash: a73dedda99e91d36e1b835633c6bd73f2beef15683671c8a49ac8f73c8af6e19
                                                        • Instruction Fuzzy Hash: 7D115172D0161AFBCF22AB95DD11E9EBBB8EF40711B14419AF801B7251DB318E509BA0
                                                        Function 00DF88B2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00DF8A56,00000000,00000000,?,00DF8859,00DF8A56,00000000,00000000,00000000,?,00DF8A56,00000006,FlsSetValue), ref: 00DF88E4
                                                        • GetLastError.KERNEL32(?,00DF8859,00DF8A56,00000000,00000000,00000000,?,00DF8A56,00000006,FlsSetValue,00E22404,00E2240C,00000000,00000364,?,00DF6230), ref: 00DF88F0
                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00DF8859,00DF8A56,00000000,00000000,00000000,?,00DF8A56,00000006,FlsSetValue,00E22404,00E2240C,00000000), ref: 00DF88FE
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: LibraryLoad$ErrorLast
                                                        • String ID:
                                                        • API String ID: 3177248105-0
                                                        • Opcode ID: 5afdeb1a51263508e52a15a899180db57bb6597a1f8c3b91167d0d052ecf6a60
                                                        • Instruction ID: 1d19f67720197245b3c2885604054d84b9d34a66ab7b80837769a7620fe75328
                                                        • Opcode Fuzzy Hash: 5afdeb1a51263508e52a15a899180db57bb6597a1f8c3b91167d0d052ecf6a60
                                                        • Instruction Fuzzy Hash: 2C01283630122AAFC7214B6A9C449777798FF05BA17164620FE15F3140DB60D8008BF2
                                                        Function 00DF615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,00000000,00DF1AEC,00000000,80004004,?,00DF1DF0,00000000,80004004,00000000,00000000), ref: 00DF6162
                                                        • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00DF61CA
                                                        • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00DF61D6
                                                        • _abort.LIBCMT ref: 00DF61DC
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$_abort
                                                        • String ID:
                                                        • API String ID: 88804580-0
                                                        • Opcode ID: c530697529bafc91071292f77eea718dd136d7d91ad5bc5288afca14cb1df4c8
                                                        • Instruction ID: 17f1b2f43f93f1e0ff86ba19d7b93feff4b2970e9a4b86a67baa5d235367de8e
                                                        • Opcode Fuzzy Hash: c530697529bafc91071292f77eea718dd136d7d91ad5bc5288afca14cb1df4c8
                                                        • Instruction Fuzzy Hash: 02F08136504B19ABC22237367C0AB3F2659DFC1771B2B8124FB18B65A6EF21D8465135
                                                        Function 00DC7435 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DC7441
                                                        • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00DC74A8
                                                        Strings
                                                        • Failed to get value as numeric for variable: %ls, xrefs: 00DC7497
                                                        • Failed to get value of variable: %ls, xrefs: 00DC747B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
                                                        • API String ID: 3168844106-4270472870
                                                        • Opcode ID: f8c34d4173f61ceea7a3adce4ba813cdb3dd244f98653a7e1ea4444fcd0d3390
                                                        • Instruction ID: 8adf5445981b2ca6870fe65a0bcc41429738cda91a2faee758c6ce86df722775
                                                        • Opcode Fuzzy Hash: f8c34d4173f61ceea7a3adce4ba813cdb3dd244f98653a7e1ea4444fcd0d3390
                                                        • Instruction Fuzzy Hash: 1B014C3294922AEBCF155F54CC05F9E7F64AF00761F108269FD04A7261C3369E509AA0
                                                        Function 00DC75AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(?), ref: 00DC75B6
                                                        • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00DC761D
                                                        Strings
                                                        • Failed to get value of variable: %ls, xrefs: 00DC75F0
                                                        • Failed to get value as version for variable: %ls, xrefs: 00DC760C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
                                                        • API String ID: 3168844106-1851729331
                                                        • Opcode ID: 34c77a4481962d9f015898369be3fbb82db9dea7586f63dc3830daf29d05df05
                                                        • Instruction ID: 503ae041cf120fcacd30b1f3caf957a5a4edda81021363fcea3d579a86e3a801
                                                        • Opcode Fuzzy Hash: 34c77a4481962d9f015898369be3fbb82db9dea7586f63dc3830daf29d05df05
                                                        • Instruction Fuzzy Hash: 77015A3295552AEBCF119F84CC09F9E3B64EF10761F104169FD04AB261D3369A919BE4
                                                        Function 00DC7539 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00DC9897,00000000,?,00000000,00000000,00000000,?,00DC96D6,00000000,?,00000000,00000000), ref: 00DC7545
                                                        • LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00DC9897,00000000,?,00000000,00000000,00000000,?,00DC96D6,00000000,?,00000000), ref: 00DC759B
                                                        Strings
                                                        • Failed to get value of variable: %ls, xrefs: 00DC756B
                                                        • Failed to copy value of variable: %ls, xrefs: 00DC758A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$EnterLeave
                                                        • String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
                                                        • API String ID: 3168844106-2936390398
                                                        • Opcode ID: ea25a133188acab3c6b6a7481ca9b4b1205b0b2cca698c2e238736c6f59b933a
                                                        • Instruction ID: 9a39a994195d41923c5096aa0100d70e108660b0174e008a890d55f1702947b4
                                                        • Opcode Fuzzy Hash: ea25a133188acab3c6b6a7481ca9b4b1205b0b2cca698c2e238736c6f59b933a
                                                        • Instruction Fuzzy Hash: 54F08132954229BBCF116F54CC09E9E3F64EF04361F008114FD04B7260C7329E919BE0
                                                        Function 00DEE776 Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00DEE788
                                                        • GetCurrentThreadId.KERNEL32 ref: 00DEE797
                                                        • GetCurrentProcessId.KERNEL32 ref: 00DEE7A0
                                                        • QueryPerformanceCounter.KERNEL32(?), ref: 00DEE7AD
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                        • String ID:
                                                        • API String ID: 2933794660-0
                                                        • Opcode ID: 1dd18ebd664187e10c27d628af0f92310d57f3fdf1cc328bfeebbd9b79c05fef
                                                        • Instruction ID: d9ec51d8bbe5cd602d8178ddb91e978b2d264f0bbf8e0231917ea4acd67f1c19
                                                        • Opcode Fuzzy Hash: 1dd18ebd664187e10c27d628af0f92310d57f3fdf1cc328bfeebbd9b79c05fef
                                                        • Instruction Fuzzy Hash: 78F09D70C1120CEFCB00DBB5D949A9EBBF8FF08301F614895A401E7110E735AB488B61
                                                        Function 00E00C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00E00DD7
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close
                                                        • String ID: regutil.cpp
                                                        • API String ID: 3535843008-955085611
                                                        • Opcode ID: ae6efa8d48bf3318329f85b241bded641b76b0de12914259860878dc0ffea134
                                                        • Instruction ID: ef973168a04567c79bb38bc4bea0255c364648a1a8788ff3dc0857dbc68f2530
                                                        • Opcode Fuzzy Hash: ae6efa8d48bf3318329f85b241bded641b76b0de12914259860878dc0ffea134
                                                        • Instruction Fuzzy Hash: CF41C332D0152AEBDB318AD4CC04BEEB7A1AB00724F259265FC44BB1D0D7759EC0ABE0
                                                        Function 00E0479B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 00E048FC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseOpen
                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                        • API String ID: 47109696-3023217399
                                                        • Opcode ID: 56c5596d9727a391865bbf47ec2bca6bca2c7024e1ec6281ad4c3790b895a6a8
                                                        • Instruction ID: 6c6df50ea989cf0502988c2e42f02b1e6c36c603b04889b2e2bfed7f6cb2164f
                                                        • Opcode Fuzzy Hash: 56c5596d9727a391865bbf47ec2bca6bca2c7024e1ec6281ad4c3790b895a6a8
                                                        • Instruction Fuzzy Hash: B541C3F5E00159EFCB24DF84CA41AAEB7B5EB44B14F159469F600B72D0D7319E80DB60
                                                        Function 00E010B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00E0112B
                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00E01163
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: QueryValue
                                                        • String ID: regutil.cpp
                                                        • API String ID: 3660427363-955085611
                                                        • Opcode ID: b3e38cf81741a984297c3d27f955d2de6cb020d4300a01cdfd783a97659563c1
                                                        • Instruction ID: a682f5b2a0db282be8a9b8062dd53b4f0bff5b64c25a2d085ce641f197269ea8
                                                        • Opcode Fuzzy Hash: b3e38cf81741a984297c3d27f955d2de6cb020d4300a01cdfd783a97659563c1
                                                        • Instruction Fuzzy Hash: DA419532D0116AFBDB249F94CC41AAEBBB9FF04354F1051ADFA10BB190D7318D919BA0
                                                        Function 00DF66D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • WideCharToMultiByte.KERNEL32(00E0B518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 00DF67A3
                                                        • GetLastError.KERNEL32 ref: 00DF67BF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ByteCharErrorLastMultiWide
                                                        • String ID: comres.dll
                                                        • API String ID: 203985260-246242247
                                                        • Opcode ID: f38ceaf0e5672654912aea9c9783147e5a18149735d75ae499c44b29b474bc14
                                                        • Instruction ID: 654fdfe85ff2f965fef588c39b5d9eba8b193c2d1ea389cfd38c389d7cc3ad68
                                                        • Opcode Fuzzy Hash: f38ceaf0e5672654912aea9c9783147e5a18149735d75ae499c44b29b474bc14
                                                        • Instruction Fuzzy Hash: 8131E234600259ABCB21BF65C885ABB7B68EF41714F1B8265FA149BD91EB70CE01C7B1
                                                        Function 00E08F7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E08E44: lstrlenW.KERNEL32(00000100,?,?,?,00E09217,000002C0,00000100,00000100,00000100,?,?,?,00DE7D87,?,?,000001BC), ref: 00E08E69
                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00E0B500,wininet.dll,?), ref: 00E0907A
                                                        • RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00E0B500,wininet.dll,?), ref: 00E09087
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                          • Part of subcall function 00E00E4F: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00DE8E1B), ref: 00E00EAA
                                                          • Part of subcall function 00E00E4F: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DE8E1B,00000000), ref: 00E00EC8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close$EnumInfoOpenQuerylstrlen
                                                        • String ID: wininet.dll
                                                        • API String ID: 2680864210-3354682871
                                                        • Opcode ID: 4bd4a92020086996f9a45025179f985fd17e6ca7e85029e020abfc93a12d9423
                                                        • Instruction ID: 261a9d34538db3069f9be69df356ec28ffc0f69cb4cead53a99f7b13506539cd
                                                        • Opcode Fuzzy Hash: 4bd4a92020086996f9a45025179f985fd17e6ca7e85029e020abfc93a12d9423
                                                        • Instruction Fuzzy Hash: 47310A32C0112AFFCF21AFA4CD409AEBBB9EF04710F555179EA51761A2D7314E91DB90
                                                        Function 00E0939E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E08E44: lstrlenW.KERNEL32(00000100,?,?,?,00E09217,000002C0,00000100,00000100,00000100,?,?,?,00DE7D87,?,?,000001BC), ref: 00E08E69
                                                        • RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00E09483
                                                        • RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00E0949D
                                                          • Part of subcall function 00E00BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00DD061A,?,00000000,00020006), ref: 00E00C0E
                                                          • Part of subcall function 00E014F4: RegSetValueExW.ADVAPI32(00020006,00E10D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DCF335,00000000,?,00020006), ref: 00E01527
                                                          • Part of subcall function 00E014F4: RegDeleteValueW.ADVAPI32(00020006,00E10D10,00000000,?,?,00DCF335,00000000,?,00020006,?,00E10D10,00020006,00000000,?,?,?), ref: 00E01557
                                                          • Part of subcall function 00E014A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00DCF28D,00E10D10,Resume,00000005,?,00000000,00000000,00000000), ref: 00E014BB
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Value$Close$CreateDeletelstrlen
                                                        • String ID: %ls\%ls
                                                        • API String ID: 3924016894-2125769799
                                                        • Opcode ID: f466f3a65f5d5bb8cf6e0322da4928d4a75b6139c752d8baa1b4a2ff9da97a5f
                                                        • Instruction ID: 884809abce7fbcf1a8bb8efa2245d1ee3892da3c4309e929d593bac219c0aa79
                                                        • Opcode Fuzzy Hash: f466f3a65f5d5bb8cf6e0322da4928d4a75b6139c752d8baa1b4a2ff9da97a5f
                                                        • Instruction Fuzzy Hash: BE313972C0012DBFCF229FD5CC8189EBBB9EF04310B4551AAF92476162D7318E91EB90
                                                        Function 00DC3A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: _memcpy_s
                                                        • String ID: crypt32.dll$wininet.dll
                                                        • API String ID: 2001391462-82500532
                                                        • Opcode ID: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                        • Instruction ID: cf5525d10179a0a94faa6132260c4b6c8fbedaa55770dcc6e535cfaa491fa6c7
                                                        • Opcode Fuzzy Hash: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                        • Instruction Fuzzy Hash: FF114F7160021AABCB08DE19CD85E9BBB69EF95250B14802AFC458B311D671EA208BE0
                                                        Function 00E014F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegSetValueExW.ADVAPI32(00020006,00E10D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00DCF335,00000000,?,00020006), ref: 00E01527
                                                        • RegDeleteValueW.ADVAPI32(00020006,00E10D10,00000000,?,?,00DCF335,00000000,?,00020006,?,00E10D10,00020006,00000000,?,?,?), ref: 00E01557
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Value$Delete
                                                        • String ID: regutil.cpp
                                                        • API String ID: 1738766685-955085611
                                                        • Opcode ID: 5b3a4882a5e173cc8e06c03c48922ec8d97956a34686452631005ab15004a1de
                                                        • Instruction ID: 67bf2f7215d38fb61060069bced5c0fd610a32c1578c39aee98fbb40d82067a0
                                                        • Opcode Fuzzy Hash: 5b3a4882a5e173cc8e06c03c48922ec8d97956a34686452631005ab15004a1de
                                                        • Instruction Fuzzy Hash: 8C110A36D11236BBDB314A945C05BAB7A14EB44764F1512A1BD02BF1D0E631CDA097E0
                                                        Function 00DCDDB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,00DE7691,00000000,IGNOREDEPENDENCIES,00000000,?,00E0B518), ref: 00DCDE04
                                                        Strings
                                                        • Failed to copy the property value., xrefs: 00DCDE38
                                                        • IGNOREDEPENDENCIES, xrefs: 00DCDDBB
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
                                                        • API String ID: 1825529933-1412343224
                                                        • Opcode ID: 3615477119411c9d643b5df0fe7609e7e98ef964371d2e2d75df0c61ad6d944b
                                                        • Instruction ID: 79ad6239a92c80227a3447c70d3291f210f758160d892fc958e05dca67b6988e
                                                        • Opcode Fuzzy Hash: 3615477119411c9d643b5df0fe7609e7e98ef964371d2e2d75df0c61ad6d944b
                                                        • Instruction Fuzzy Hash: 8A110632604316AFCB115F94CC84FAA77ABAF54320F25417DFA59AF291C7709850CBA0
                                                        Function 00E0563F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00DD8E97,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00E0566E
                                                        • SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00DD8E97,?), ref: 00E05689
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: InfoNamedSecuritySleep
                                                        • String ID: aclutil.cpp
                                                        • API String ID: 2352087905-2159165307
                                                        • Opcode ID: a8304ea9c9267fa7e4bdd80451274f7d02f41049e766619fe6edd8cd73c2d468
                                                        • Instruction ID: c6f611b79424b9ac04e1e4915172f4b167cb98fac360d0ece39148ce16b735c7
                                                        • Opcode Fuzzy Hash: a8304ea9c9267fa7e4bdd80451274f7d02f41049e766619fe6edd8cd73c2d468
                                                        • Instruction Fuzzy Hash: D0017C33801629BBCF229E85ED05E9F7B65EF84754F060215BD0476260C6338DA09EE0
                                                        Function 00DC158C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LCMapStringW.KERNEL32(0000007F,00000000,00000000,00DD70E8,00000000,00DD70E8,00000000,00000000,00DD70E8,00000000,00000000,00000000,?,00DC2318,00000000,00000000), ref: 00DC15D0
                                                        • GetLastError.KERNEL32(?,00DC2318,00000000,00000000,00DD70E8,00000200,?,00E052B2,00000000,00DD70E8,00000000,00DD70E8,00000000,00000000,00000000), ref: 00DC15DA
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastString
                                                        • String ID: strutil.cpp
                                                        • API String ID: 3728238275-3612885251
                                                        • Opcode ID: e63801cade881556cb3ade03c6c9e856f7d80a62af6bc176da4b2cd20c4e820f
                                                        • Instruction ID: 5f60bfbb044ffa9779b3c2a533e24f577eef024619d518f4f076e9db1eab93b8
                                                        • Opcode Fuzzy Hash: e63801cade881556cb3ade03c6c9e856f7d80a62af6bc176da4b2cd20c4e820f
                                                        • Instruction Fuzzy Hash: 45015237941637678B219E998C44F5B7A69EF87B60B090618FE14BB251D621DC1087F0
                                                        Function 00DD57BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 00DD57D9
                                                        • CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00DD5833
                                                        Strings
                                                        • Failed to initialize COM on cache thread., xrefs: 00DD57E5
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: InitializeUninitialize
                                                        • String ID: Failed to initialize COM on cache thread.
                                                        • API String ID: 3442037557-3629645316
                                                        • Opcode ID: 5aa7a2feaf7006c6f4535813cccaca05d7ed43813d17cca63a3314e51c3321c0
                                                        • Instruction ID: d7f80aad61c87ebc9e76f114425a302924dc2b1994f80298f63cc9bdd1c1ef72
                                                        • Opcode Fuzzy Hash: 5aa7a2feaf7006c6f4535813cccaca05d7ed43813d17cca63a3314e51c3321c0
                                                        • Instruction Fuzzy Hash: 9F016D72600619BFC7059FA5E884EDAFBADFF08350B108126FA09D7221DB31AD54DBE0
                                                        Function 00E03BF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00E00F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00E2AAA0,00000000,?,00E057E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00E00F80
                                                        • RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00E03A8E,?), ref: 00E03C62
                                                        Strings
                                                        • EnableLUA, xrefs: 00E03C34
                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00E03C0C
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseOpen
                                                        • String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
                                                        • API String ID: 47109696-3551287084
                                                        • Opcode ID: 6875be96fd97bb55cfc31bebd09fad45d86c6d7f757ea6b34b101e8d7a7fddbb
                                                        • Instruction ID: 0b809301c7c35e26dcc4272ae2e48dd11bd9bde7cc932fbcb42553b28b3366aa
                                                        • Opcode Fuzzy Hash: 6875be96fd97bb55cfc31bebd09fad45d86c6d7f757ea6b34b101e8d7a7fddbb
                                                        • Instruction Fuzzy Hash: BD017C32910239FBE7209AB4D846BEEF6ACDB14721F2052A5A900F7091D3755ED096E0
                                                        Function 00DC5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00DC1104,?,?,00000000), ref: 00DC5142
                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00DC1104,?,?,00000000), ref: 00DC5172
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareStringlstrlen
                                                        • String ID: burn.clean.room
                                                        • API String ID: 1433953587-3055529264
                                                        • Opcode ID: 6e758c5c580be20c4e75f128b5aa72c6547cad9d832e9e56401be568093347ea
                                                        • Instruction ID: bd071b4387e226fb90d8d5a6b49064b43a4ad9ab4fc90441bdcd7646380617c5
                                                        • Opcode Fuzzy Hash: 6e758c5c580be20c4e75f128b5aa72c6547cad9d832e9e56401be568093347ea
                                                        • Instruction Fuzzy Hash: 2B014FB29007256F87344B8AAD89F63B7ACFB15760B1C422AF509E3614D771AC85C6B1
                                                        Function 00E06920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SysFreeString.OLEAUT32(00000000), ref: 00E06985
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FreeString
                                                        • String ID: `Dv$atomutil.cpp
                                                        • API String ID: 3341692771-1153537316
                                                        • Opcode ID: 4e292966d5122972322d765d1545baa01f714e2e355db8e6c410f56c9050478f
                                                        • Instruction ID: 8fe61b673793fd2c02b6ec0ff318e52c945299aae87bd5683c475c9734a55aab
                                                        • Opcode Fuzzy Hash: 4e292966d5122972322d765d1545baa01f714e2e355db8e6c410f56c9050478f
                                                        • Instruction Fuzzy Hash: 4101F432800224FBC7226A94DC01FAEF7B8EF84B21F645159B8007B5D0C7B64EA0E6E0
                                                        Function 00DC6522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(?), ref: 00DC6534
                                                          • Part of subcall function 00E00ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00DC5EB2,00000000), ref: 00E00AE0
                                                          • Part of subcall function 00E00ACC: GetProcAddress.KERNEL32(00000000), ref: 00E00AE7
                                                          • Part of subcall function 00E00ACC: GetLastError.KERNEL32(?,?,?,00DC5EB2,00000000), ref: 00E00AFE
                                                          • Part of subcall function 00DC5CE2: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00DC5D68
                                                        Strings
                                                        • Failed to get 64-bit folder., xrefs: 00DC6557
                                                        • Failed to set variant value., xrefs: 00DC6571
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
                                                        • String ID: Failed to get 64-bit folder.$Failed to set variant value.
                                                        • API String ID: 3109562764-2681622189
                                                        • Opcode ID: 7d7eaf3f978a9e88fd360a5ee116cd5f162b1fd8f12072ba6da672da6e8f7f24
                                                        • Instruction ID: 4776a7676107394cb897a90b5859f8795219932db2bcc3c8a7428f8e0eb4df64
                                                        • Opcode Fuzzy Hash: 7d7eaf3f978a9e88fd360a5ee116cd5f162b1fd8f12072ba6da672da6e8f7f24
                                                        • Instruction Fuzzy Hash: B2014F32D15229BBCB21AB94DD06E9EBB78EB04721F604159F80077195D671DF90DAE0
                                                        Function 00DC33C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00DC10DD,?,00000000), ref: 00DC33E8
                                                        • GetLastError.KERNEL32(?,?,?,?,00DC10DD,?,00000000), ref: 00DC33FF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastModuleName
                                                        • String ID: pathutil.cpp
                                                        • API String ID: 2776309574-741606033
                                                        • Opcode ID: 6be4cf2bd249cfd81ac8531602b0e4c509b69eadf8f1600cfd7cd499547d6057
                                                        • Instruction ID: 5ca014ba8472857a96dbd2807d41195e36ec42ae46e692e37d479871204595bd
                                                        • Opcode Fuzzy Hash: 6be4cf2bd249cfd81ac8531602b0e4c509b69eadf8f1600cfd7cd499547d6057
                                                        • Instruction Fuzzy Hash: 29F0C273A4553367C72256965C45F8BFA58EB46B70B168129FD44BB240DA62DD0082F0
                                                        Function 00DEE30F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00DEEBD2
                                                          • Part of subcall function 00DF1380: RaiseException.KERNEL32(?,?,?,00DEEBF4,?,00000000,00000000,?,?,?,?,?,00DEEBF4,?,00E27EC8), ref: 00DF13DF
                                                        • __CxxThrowException@8.LIBVCRUNTIME ref: 00DEEBEF
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Exception@8Throw$ExceptionRaise
                                                        • String ID: Unknown exception
                                                        • API String ID: 3476068407-410509341
                                                        • Opcode ID: 2f110a2c9cdc0b09ee196b69d981af83f2252411eaa5c5b9dd5cfa51218f4628
                                                        • Instruction ID: 19323c086159744da14419b377ae6b056306dd8cf64a27121d509767f9cf1843
                                                        • Opcode Fuzzy Hash: 2f110a2c9cdc0b09ee196b69d981af83f2252411eaa5c5b9dd5cfa51218f4628
                                                        • Instruction Fuzzy Hash: 0CF0F63990030CBBCF00BAA6EC56DAD776CDE00350B648564F925A64D2EB71EA55C6F0
                                                        Function 00E04A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetFileSizeEx.KERNEL32(00000000,00000000,00000000,762334C0,?,?,?,00DCBA1D,?,?,?,00000000,00000000), ref: 00E04A1D
                                                        • GetLastError.KERNEL32(?,?,?,00DCBA1D,?,?,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 00E04A27
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastSize
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 464720113-2967768451
                                                        • Opcode ID: c2853f3d73947306cd9cafdbd17f3e2337a46d590dc733ead9a2d7a3eadaa920
                                                        • Instruction ID: c755d4c33876b86292ce922f86bc0a3d86ece46e43cab319c1a173912b49040f
                                                        • Opcode Fuzzy Hash: c2853f3d73947306cd9cafdbd17f3e2337a46d590dc733ead9a2d7a3eadaa920
                                                        • Instruction Fuzzy Hash: CFF081F2A4023AABD7109B85990595AFBBCFF44720B01411ABE44B7380E771AD4087E4
                                                        Function 00E03D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36comCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00DC5466,?,00000000,00DC5466,?,?,?), ref: 00E03DA7
                                                        • CoCreateInstance.OLE32(00000000,00000000,00000001,00E2716C,?), ref: 00E03DBF
                                                        Strings
                                                        • Microsoft.Update.AutoUpdate, xrefs: 00E03DA2
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateFromInstanceProg
                                                        • String ID: Microsoft.Update.AutoUpdate
                                                        • API String ID: 2151042543-675569418
                                                        • Opcode ID: 875816698c57a8089825ff88ab46b28fbe51d3cd1a6d49892f8551381bc2496a
                                                        • Instruction ID: 3bba3d17df8f5b66636d505a32cc835a5c1f7cdb2b138f50ea34c09098c81a38
                                                        • Opcode Fuzzy Hash: 875816698c57a8089825ff88ab46b28fbe51d3cd1a6d49892f8551381bc2496a
                                                        • Instruction Fuzzy Hash: 55F05471611219BFD710EFA9ED05AEFB7BDEB09710F500065EA01F7150D6B1AE0487B2
                                                        Function 00E00E07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00E00E28
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.2462168369.0000000000DC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DC0000, based on PE: true
                                                        • Associated: 00000000.00000002.2462150879.0000000000DC0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462205381.0000000000E0B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462316133.0000000000E2A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.2462429329.0000000000E2D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_dc0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc
                                                        • String ID: AdvApi32.dll$RegDeleteKeyExW
                                                        • API String ID: 190572456-850864035
                                                        • Opcode ID: 86357052397ce611692dc57093f37731cdd99641d2b72c2ec5a08ca941fb18b6
                                                        • Instruction ID: 4b42c51dfb00525500353c4612751a36fc2de71c5030783be404cbd21de5ecd5
                                                        • Opcode Fuzzy Hash: 86357052397ce611692dc57093f37731cdd99641d2b72c2ec5a08ca941fb18b6
                                                        • Instruction Fuzzy Hash: FBE012B05013719FCB319F16FC05B427F91E710B58F045264E404B65B0D3B6488ACFD0

                                                        Executed Functions

                                                        Function 008F1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 008F33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,008F10DD,?,00000000), ref: 008F33E8
                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 008F10F6
                                                          • Part of subcall function 008F1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,008F111A,cabinet.dll,00000009,?,?,00000000), ref: 008F1186
                                                          • Part of subcall function 008F1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,008F111A,cabinet.dll,00000009,?,?,00000000), ref: 008F1191
                                                          • Part of subcall function 008F1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 008F119F
                                                          • Part of subcall function 008F1175: GetLastError.KERNEL32(?,?,?,?,?,008F111A,cabinet.dll,00000009,?,?,00000000), ref: 008F11BA
                                                          • Part of subcall function 008F1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 008F11C2
                                                          • Part of subcall function 008F1175: GetLastError.KERNEL32(?,?,?,?,?,008F111A,cabinet.dll,00000009,?,?,00000000), ref: 008F11D7
                                                        • CloseHandle.KERNEL32(?,?,?,?,0093B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 008F1131
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                        • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                        • API String ID: 3687706282-3151496603
                                                        • Opcode ID: 3e1575b3e23d0465cedb47aec7a4e932561f4e3adc82248f23e6dbfb75c03b1d
                                                        • Instruction ID: 791f8ff7de2a5a45098837a0ccb00733255904f6612683e5c178f794b29eee9a
                                                        • Opcode Fuzzy Hash: 3e1575b3e23d0465cedb47aec7a4e932561f4e3adc82248f23e6dbfb75c03b1d
                                                        • Instruction Fuzzy Hash: 01212671A0021CABDB20AFB9DC49BEEBBB8FB49714F504119EB10B6291D77099448FA5
                                                        Function 0092FEC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(0095B5FC,00000000,?,?,?,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 0092FEF4
                                                        • GetCurrentProcessId.KERNEL32(00000000,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 0092FF04
                                                        • GetCurrentThreadId.KERNEL32 ref: 0092FF0D
                                                        • GetLocalTime.KERNEL32(8000FFFF,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 0092FF23
                                                        • LeaveCriticalSection.KERNEL32(0095B5FC,0090E93B,?,00000000,0000FDE9,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 0093001A
                                                        Strings
                                                        • %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0092FFC0
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                        • String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
                                                        • API String ID: 296830338-59366893
                                                        • Opcode ID: 015587df74e15d0b4eaca60a5ec97cb258c65ae9b89439a5e1c76b9e340bdc58
                                                        • Instruction ID: cd830a285ca883b38afa6d3be56b6c1d121a1336c1c53d43aa546b48b0a0e8ed
                                                        • Opcode Fuzzy Hash: 015587df74e15d0b4eaca60a5ec97cb258c65ae9b89439a5e1c76b9e340bdc58
                                                        • Instruction Fuzzy Hash: E1417C71A05219ABDF25DFA5D915BBEB6B8EB48712F000035FA01A7250E7348D41DFA1
                                                        Function 0090A0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        • Failed to calculate working folder to ensure it exists., xrefs: 0090A0D8
                                                        • Failed create working folder., xrefs: 0090A0EE
                                                        • Failed to copy working folder., xrefs: 0090A116
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentDirectoryErrorLastProcessWindows
                                                        • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                        • API String ID: 3841436932-2072961686
                                                        • Opcode ID: 38f5760868d816bcbac6351e6cb1aded2659af89ffba846dd4307ca5190122e3
                                                        • Instruction ID: 87e6bb287b13045dbf2efe7ccaf2f2d05e45a453d420c664ee178b7f7661887f
                                                        • Opcode Fuzzy Hash: 38f5760868d816bcbac6351e6cb1aded2659af89ffba846dd4307ca5190122e3
                                                        • Instruction Fuzzy Hash: 0001D83290562CFFCB225A54DC06C6F7A79DFD5720B104155F810B6150DB319E10AAC2
                                                        Function 00905C33 Relevance: 218.0, APIs: 60, Strings: 64, Instructions: 1034COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _wcschr.LIBVCRUNTIME ref: 00905C99
                                                        • CompareStringW.KERNEL32(0000007F,00000001,008F5403,000000FF,00945A1C,000000FF,008F53BD,00000000,008F5445,?), ref: 00905D26
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,log,000000FF), ref: 00905D49
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,00945A60,000000FF), ref: 00905D6C
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,00945A64,000000FF), ref: 00905D8F
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,help,000000FF), ref: 00905DB2
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,00945A74,000000FF), ref: 00905DD5
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,quiet,000000FF), ref: 00905DF8
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,00945A84,000000FF), ref: 00905E1B
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,silent,000000FF), ref: 00905E3E
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,passive,000000FF), ref: 00905E61
                                                        • CompareStringW.KERNEL32(0000007F,00000001,-00000002,000000FF,norestart,000000FF), ref: 00905E9B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString$_wcschr
                                                        • String ID: %ls=*****$-$/$Failed to allocate the list of ancestors.$Failed to allocate the list of dependencies to ignore.$Failed to copy append log file path.$Failed to copy last used source.$Failed to copy log file path.$Failed to copy parent.$Failed to copy path for layout directory.$Failed to copy sanitized argument.$Failed to copy source process path.$Failed to copy variable name.$Failed to determine whether variable is hidden.$Failed to initialize parent to none.$Failed to parse elevated connection.$Failed to parse embedded connection.$Missing required parameter for switch: %ls$Multiple mode command-line switches were provided.$Must specify a path for append log.$Must specify a path for log.$Must specify a path for original source.$Must specify a value for parent.$Must specify the elevated name, token and parent process id.$Must specify the embedded name, token and parent process id.$burn.$burn.ancestors$burn.clean.room$burn.disable.unelevate$burn.elevated$burn.embedded$burn.filehandle.attached$burn.filehandle.self$burn.ignoredependencies$burn.log.append$burn.passthrough$burn.related.addon$burn.related.detect$burn.related.patch$burn.related.update$burn.related.upgrade$burn.runonce$core.cpp$disablesystemrestore$forcerestart$help$keepaupaused$layout$log$modify$msi.dll$noaupause$norestart$originalsource$package$parent$parent:none$passive$promptrestart$quiet$repair$silent$uninstall$update
                                                        • API String ID: 2689612863-420850958
                                                        • Opcode ID: 91c9da0b501b21b79f707cd9291261da5b2bf75c012c77b3b7a76f4efe9c0519
                                                        • Instruction ID: d194344ea8214b3e22cfa24c65735ad1ca6c2213aa35ad87232d29a5aa8b8ebe
                                                        • Opcode Fuzzy Hash: 91c9da0b501b21b79f707cd9291261da5b2bf75c012c77b3b7a76f4efe9c0519
                                                        • Instruction Fuzzy Hash: 8472F271658305BFDB208F88CC86F7A36AAEB41738F604614F665EB2E0C7B59D60DB10
                                                        Function 008FF9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 243 8ff9e3-8ffa14 call 9339af 246 8ffa18-8ffa1a 243->246 247 8ffa16 243->247 248 8ffa2e-8ffa47 call 9332f3 246->248 249 8ffa1c-8ffa29 call 930237 246->249 247->246 255 8ffa49-8ffa4e 248->255 256 8ffa53-8ffa68 call 9332f3 248->256 254 8fff16-8fff1b 249->254 257 8fff1d-8fff1f 254->257 258 8fff23-8fff28 254->258 259 8fff0d-8fff14 call 930237 255->259 265 8ffa6a-8ffa6f 256->265 266 8ffa74-8ffa81 call 8fea42 256->266 257->258 262 8fff2a-8fff2c 258->262 263 8fff30-8fff35 258->263 271 8fff15 259->271 262->263 268 8fff3d-8fff41 263->268 269 8fff37-8fff39 263->269 265->259 276 8ffa8d-8ffaa2 call 9332f3 266->276 277 8ffa83-8ffa88 266->277 272 8fff4b-8fff52 268->272 273 8fff43-8fff46 call 935636 268->273 269->268 271->254 273->272 280 8ffaae-8ffac0 call 934c97 276->280 281 8ffaa4-8ffaa9 276->281 277->259 284 8ffacf-8ffae4 call 9332f3 280->284 285 8ffac2-8ffaca 280->285 281->259 290 8ffae6-8ffaeb 284->290 291 8ffaf0-8ffb05 call 9332f3 284->291 286 8ffd99-8ffda2 call 930237 285->286 286->271 290->259 295 8ffb07-8ffb0c 291->295 296 8ffb11-8ffb23 call 933505 291->296 295->259 299 8ffb2f-8ffb45 call 9339af 296->299 300 8ffb25-8ffb2a 296->300 303 8ffb4b-8ffb4d 299->303 304 8ffdf4-8ffe0e call 8fecbe 299->304 300->259 305 8ffb4f-8ffb54 303->305 306 8ffb59-8ffb6e call 933505 303->306 311 8ffe1a-8ffe32 call 9339af 304->311 312 8ffe10-8ffe15 304->312 305->259 313 8ffb7a-8ffb8f call 9332f3 306->313 314 8ffb70-8ffb75 306->314 319 8ffefc-8ffefd call 8ff0f8 311->319 320 8ffe38-8ffe3a 311->320 312->259 321 8ffb9f-8ffbb4 call 9332f3 313->321 322 8ffb91-8ffb93 313->322 314->259 329 8fff02-8fff06 319->329 323 8ffe3c-8ffe41 320->323 324 8ffe46-8ffe64 call 9332f3 320->324 333 8ffbb6-8ffbb8 321->333 334 8ffbc4-8ffbd9 call 9332f3 321->334 322->321 326 8ffb95-8ffb9a 322->326 323->259 335 8ffe66-8ffe6b 324->335 336 8ffe70-8ffe88 call 9332f3 324->336 326->259 329->271 330 8fff08 329->330 330->259 333->334 337 8ffbba-8ffbbf 333->337 344 8ffbdb-8ffbdd 334->344 345 8ffbe9-8ffbfe call 9332f3 334->345 335->259 342 8ffe8a-8ffe8c 336->342 343 8ffe95-8ffead call 9332f3 336->343 337->259 342->343 349 8ffe8e-8ffe93 342->349 352 8ffeaf-8ffeb1 343->352 353 8ffeba-8ffed2 call 9332f3 343->353 344->345 346 8ffbdf-8ffbe4 344->346 354 8ffc0e-8ffc23 call 9332f3 345->354 355 8ffc00-8ffc02 345->355 346->259 349->259 352->353 356 8ffeb3-8ffeb8 352->356 362 8ffedb-8ffef3 call 9332f3 353->362 363 8ffed4-8ffed9 353->363 364 8ffc25-8ffc27 354->364 365 8ffc33-8ffc48 call 9332f3 354->365 355->354 357 8ffc04-8ffc09 355->357 356->259 357->259 362->319 371 8ffef5-8ffefa 362->371 363->259 364->365 367 8ffc29-8ffc2e 364->367 372 8ffc4a-8ffc4c 365->372 373 8ffc58-8ffc6d call 9332f3 365->373 367->259 371->259 372->373 375 8ffc4e-8ffc53 372->375 377 8ffc6f-8ffc71 373->377 378 8ffc7d-8ffc92 call 9332f3 373->378 375->259 377->378 379 8ffc73-8ffc78 377->379 382 8ffc94-8ffc96 378->382 383 8ffca2-8ffcba call 9332f3 378->383 379->259 382->383 384 8ffc98-8ffc9d 382->384 387 8ffcbc-8ffcbe 383->387 388 8ffcca-8ffce2 call 9332f3 383->388 384->259 387->388 390 8ffcc0-8ffcc5 387->390 392 8ffce4-8ffce6 388->392 393 8ffcf2-8ffd07 call 9332f3 388->393 390->259 392->393 394 8ffce8-8ffced 392->394 397 8ffd0d-8ffd2a CompareStringW 393->397 398 8ffda7-8ffda9 393->398 394->259 401 8ffd2c-8ffd32 397->401 402 8ffd34-8ffd49 CompareStringW 397->402 399 8ffdab-8ffdb2 398->399 400 8ffdb4-8ffdb6 398->400 399->400 403 8ffdb8-8ffdbd 400->403 404 8ffdc2-8ffdda call 933505 400->404 405 8ffd75-8ffd7a 401->405 406 8ffd4b-8ffd55 402->406 407 8ffd57-8ffd6c CompareStringW 402->407 403->259 404->304 414 8ffddc-8ffdde 404->414 405->400 406->405 409 8ffd6e 407->409 410 8ffd7c-8ffd94 call 8f3821 407->410 409->405 410->286 415 8ffdea 414->415 416 8ffde0-8ffde5 414->416 415->304 416->259
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: StringVariant$AllocClearFreeInit
                                                        • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
                                                        • API String ID: 760788290-2956246334
                                                        • Opcode ID: f39dc2ad39bdaa53793f326aaf2a81fa38d4ce4614ce8021423d9635c0298933
                                                        • Instruction ID: 2e4f661d6e39b179cb449225edcd6a72a83f9f04653a28bfafbb2b1f57aad0a2
                                                        • Opcode Fuzzy Hash: f39dc2ad39bdaa53793f326aaf2a81fa38d4ce4614ce8021423d9635c0298933
                                                        • Instruction Fuzzy Hash: D5E1B432E8467EBACB21AA70CC42EBEA664FF45718F114271FB21F6192DB619D4096C0
                                                        Function 008FB48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 417 8fb48b-8fb500 call 91f8e0 * 2 422 8fb538-8fb53e 417->422 423 8fb502-8fb50c GetLastError 417->423 426 8fb542-8fb554 SetFilePointerEx 422->426 427 8fb540 422->427 424 8fb50e-8fb517 423->424 425 8fb519 423->425 424->425 428 8fb51b 425->428 429 8fb520-8fb52d call 8f3821 425->429 430 8fb588-8fb5a2 ReadFile 426->430 431 8fb556-8fb560 GetLastError 426->431 427->426 428->429 447 8fb532-8fb533 429->447 432 8fb5d9-8fb5e0 430->432 433 8fb5a4-8fb5ae GetLastError 430->433 435 8fb56d 431->435 436 8fb562-8fb56b 431->436 440 8fbbd7-8fbbeb call 8f3821 432->440 441 8fb5e6-8fb5ef 432->441 437 8fb5bb 433->437 438 8fb5b0-8fb5b9 433->438 442 8fb56f 435->442 443 8fb574-8fb586 call 8f3821 435->443 436->435 445 8fb5bd 437->445 446 8fb5c2-8fb5d4 call 8f3821 437->446 438->437 459 8fbbf0 440->459 441->440 449 8fb5f5-8fb605 SetFilePointerEx 441->449 442->443 443->447 445->446 446->447 452 8fbbf1-8fbbf7 call 930237 447->452 454 8fb63c-8fb654 ReadFile 449->454 455 8fb607-8fb611 GetLastError 449->455 470 8fbbf8-8fbc0a call 91e06f 452->470 456 8fb68b-8fb692 454->456 457 8fb656-8fb660 GetLastError 454->457 461 8fb61e 455->461 462 8fb613-8fb61c 455->462 463 8fbbbc-8fbbd5 call 8f3821 456->463 464 8fb698-8fb6a2 456->464 467 8fb66d 457->467 468 8fb662-8fb66b 457->468 459->452 465 8fb625-8fb632 call 8f3821 461->465 466 8fb620 461->466 462->461 463->459 464->463 471 8fb6a8-8fb6cb SetFilePointerEx 464->471 465->454 466->465 474 8fb66f 467->474 475 8fb674-8fb681 call 8f3821 467->475 468->467 477 8fb6cd-8fb6d7 GetLastError 471->477 478 8fb702-8fb71a ReadFile 471->478 474->475 475->456 483 8fb6d9-8fb6e2 477->483 484 8fb6e4 477->484 485 8fb71c-8fb726 GetLastError 478->485 486 8fb751-8fb769 ReadFile 478->486 483->484 490 8fb6eb-8fb6f8 call 8f3821 484->490 491 8fb6e6 484->491 492 8fb728-8fb731 485->492 493 8fb733 485->493 488 8fb76b-8fb775 GetLastError 486->488 489 8fb7a0-8fb7bb SetFilePointerEx 486->489 494 8fb777-8fb780 488->494 495 8fb782 488->495 497 8fb7bd-8fb7c7 GetLastError 489->497 498 8fb7f5-8fb814 ReadFile 489->498 490->478 491->490 492->493 499 8fb73a-8fb747 call 8f3821 493->499 500 8fb735 493->500 494->495 504 8fb789-8fb796 call 8f3821 495->504 505 8fb784 495->505 507 8fb7c9-8fb7d2 497->507 508 8fb7d4 497->508 502 8fbb7d-8fbb87 GetLastError 498->502 503 8fb81a-8fb81c 498->503 499->486 500->499 514 8fbb89-8fbb92 502->514 515 8fbb94 502->515 512 8fb81d-8fb824 503->512 504->489 505->504 507->508 509 8fb7db-8fb7eb call 8f3821 508->509 510 8fb7d6 508->510 509->498 510->509 517 8fb82a-8fb836 512->517 518 8fbb58-8fbb75 call 8f3821 512->518 514->515 520 8fbb9b-8fbbb1 call 8f3821 515->520 521 8fbb96 515->521 524 8fb838-8fb83f 517->524 525 8fb841-8fb84a 517->525 533 8fbb7a-8fbb7b 518->533 532 8fbbb2-8fbbba call 930237 520->532 521->520 524->525 528 8fb884-8fb88b 524->528 530 8fbb1b-8fbb32 call 8f3821 525->530 531 8fb850-8fb876 ReadFile 525->531 535 8fb88d-8fb8af call 8f3821 528->535 536 8fb8b4-8fb8cb call 8f394f 528->536 543 8fbb37-8fbb3d call 930237 530->543 531->502 534 8fb87c-8fb882 531->534 532->470 533->532 534->512 535->533 547 8fb8ef-8fb904 SetFilePointerEx 536->547 548 8fb8cd-8fb8ea call 8f3821 536->548 553 8fbb43-8fbb44 543->553 551 8fb906-8fb910 GetLastError 547->551 552 8fb944-8fb969 ReadFile 547->552 548->452 557 8fb91d 551->557 558 8fb912-8fb91b 551->558 554 8fb96b-8fb975 GetLastError 552->554 555 8fb9a0-8fb9ac 552->555 559 8fbb45-8fbb47 553->559 560 8fb977-8fb980 554->560 561 8fb982 554->561 562 8fb9cf-8fb9d3 555->562 563 8fb9ae-8fb9ca call 8f3821 555->563 564 8fb91f 557->564 565 8fb924-8fb934 call 8f3821 557->565 558->557 559->470 566 8fbb4d-8fbb53 call 8f3a16 559->566 560->561 567 8fb989-8fb99e call 8f3821 561->567 568 8fb984 561->568 571 8fba0e-8fba21 call 934a05 562->571 572 8fb9d5-8fba09 call 8f3821 call 930237 562->572 563->543 564->565 583 8fb939-8fb93f call 930237 565->583 566->470 567->583 568->567 586 8fba2d-8fba37 571->586 587 8fba23-8fba28 571->587 572->559 583->553 590 8fba39-8fba3f 586->590 591 8fba41-8fba49 586->591 587->583 592 8fba5a-8fbaba call 8f394f 590->592 593 8fba4b-8fba53 591->593 594 8fba55-8fba58 591->594 597 8fbade-8fbaff call 91f360 call 8fb208 592->597 598 8fbabc-8fbad8 call 8f3821 592->598 593->592 594->592 597->559 605 8fbb01-8fbb11 call 8f3821 597->605 598->597 605->530
                                                        APIs
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 008FB502
                                                        • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB550
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 008FB556
                                                        • ReadFile.KERNELBASE(00000000,008F4461,00000040,?,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB59E
                                                        • GetLastError.KERNEL32(?,?,?,00000000,7736C3F0,00000000), ref: 008FB5A4
                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB601
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB607
                                                        • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB650
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB656
                                                        • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB6C7
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB6CD
                                                        • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB716
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB71C
                                                        • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB765
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB76B
                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB7B7
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB7BD
                                                          • Part of subcall function 008F394F: GetProcessHeap.KERNEL32(?,?,?,008F2274,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000,00000000,8000FFFF), ref: 008F3960
                                                          • Part of subcall function 008F394F: RtlAllocateHeap.NTDLL(00000000,?,008F2274,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000,00000000,8000FFFF), ref: 008F3967
                                                        • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB810
                                                        • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB872
                                                        • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB8FC
                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7736C3F0,00000000), ref: 008FB906
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                        • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to user process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
                                                        • API String ID: 3411815225-695169583
                                                        • Opcode ID: 29424699a96e267d4c227cd38e2a9832d78152ba338c8b182ef75a42048c93a4
                                                        • Instruction ID: fb1cceaf27eb258ae70e8188df21f5847c963de69ec5e7e0575044692faccd20
                                                        • Opcode Fuzzy Hash: 29424699a96e267d4c227cd38e2a9832d78152ba338c8b182ef75a42048c93a4
                                                        • Instruction Fuzzy Hash: 4412A076A4023DABDB309A65CC45FBA7AA4FB84764F1141A5FB04FB280E7749D408FE1
                                                        Function 00910D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 608 910d16-910d2d SetEvent 609 910d6f-910d7d WaitForSingleObject 608->609 610 910d2f-910d39 GetLastError 608->610 613 910db4-910dbf ResetEvent 609->613 614 910d7f-910d89 GetLastError 609->614 611 910d46 610->611 612 910d3b-910d44 610->612 617 910d48 611->617 618 910d4d-910d5d call 8f3821 611->618 612->611 619 910dc1-910dcb GetLastError 613->619 620 910df9-910dff 613->620 615 910d96 614->615 616 910d8b-910d94 614->616 621 910d98 615->621 622 910d9d-910db2 call 8f3821 615->622 616->615 617->618 639 910d62-910d6a call 930237 618->639 623 910dd8 619->623 624 910dcd-910dd6 619->624 626 910e01-910e04 620->626 627 910e32-910e4b call 8f21ac 620->627 621->622 622->639 632 910dda 623->632 633 910ddf-910df4 call 8f3821 623->633 624->623 628 910e06-910e23 call 8f3821 626->628 629 910e28-910e2d 626->629 642 910e63-910e6e SetEvent 627->642 643 910e4d-910e5e call 930237 627->643 648 9110de-9110e4 call 930237 628->648 636 9110e8-9110ed 629->636 632->633 633->639 644 9110f2-9110f8 636->644 645 9110ef 636->645 639->636 650 910e70-910e7a GetLastError 642->650 651 910ea8-910eb6 WaitForSingleObject 642->651 662 9110e5-9110e7 643->662 645->644 648->662 657 910e87 650->657 658 910e7c-910e85 650->658 653 910ef0-910efb ResetEvent 651->653 654 910eb8-910ec2 GetLastError 651->654 663 910f35-910f3c 653->663 664 910efd-910f07 GetLastError 653->664 659 910ec4-910ecd 654->659 660 910ecf 654->660 665 910e89 657->665 666 910e8e-910ea3 call 8f3821 657->666 658->657 659->660 670 910ed1 660->670 671 910ed6-910eeb call 8f3821 660->671 662->636 668 910fab-910fce CreateFileW 663->668 669 910f3e-910f41 663->669 672 910f14 664->672 673 910f09-910f12 664->673 665->666 683 9110dd 666->683 675 910fd0-910fda GetLastError 668->675 676 91100b-91101f SetFilePointerEx 668->676 677 910f43-910f46 669->677 678 910f6e-910f72 call 8f394f 669->678 670->671 671->683 680 910f16 672->680 681 910f1b-910f30 call 8f3821 672->681 673->672 684 910fe7 675->684 685 910fdc-910fe5 675->685 689 911021-91102b GetLastError 676->689 690 911059-911064 SetEndOfFile 676->690 686 910f67-910f69 677->686 687 910f48-910f4b 677->687 701 910f77-910f7c 678->701 680->681 681->683 683->648 695 910fe9 684->695 696 910fee-911001 call 8f3821 684->696 685->684 686->636 697 910f5d-910f62 687->697 698 910f4d-910f53 687->698 699 911038 689->699 700 91102d-911036 689->700 693 911066-911070 GetLastError 690->693 694 91109b-9110a8 SetFilePointerEx 690->694 702 911072-91107b 693->702 703 91107d 693->703 694->662 705 9110aa-9110b4 GetLastError 694->705 695->696 696->676 697->662 698->697 708 91103a 699->708 709 91103f-911054 call 8f3821 699->709 700->699 706 910f9d-910fa6 701->706 707 910f7e-910f98 call 8f3821 701->707 702->703 711 911084-911099 call 8f3821 703->711 712 91107f 703->712 714 9110c1 705->714 715 9110b6-9110bf 705->715 706->662 707->683 708->709 709->683 711->683 712->711 719 9110c3 714->719 720 9110c8-9110d8 call 8f3821 714->720 715->714 719->720 720->683
                                                        APIs
                                                        • SetEvent.KERNEL32(?,?,?,?,?,009108BC,?,?), ref: 00910D25
                                                        • GetLastError.KERNEL32(?,?,?,?,009108BC,?,?), ref: 00910D2F
                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,009108BC,?,?), ref: 00910D74
                                                        • GetLastError.KERNEL32(?,?,?,?,009108BC,?,?), ref: 00910D7F
                                                        • ResetEvent.KERNEL32(?,?,?,?,?,009108BC,?,?), ref: 00910DB7
                                                        • GetLastError.KERNEL32(?,?,?,?,009108BC,?,?), ref: 00910DC1
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                        • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 1865021742-2104912459
                                                        • Opcode ID: c476586c1d87ea3debb3db68afcd504bb913be74445bfc2f4e4a7bf0c6cf14a0
                                                        • Instruction ID: 15fc916f0df62bea1c4924fd195248dde3b4423a6861ef2edf8fe8f9eb6effcc
                                                        • Opcode Fuzzy Hash: c476586c1d87ea3debb3db68afcd504bb913be74445bfc2f4e4a7bf0c6cf14a0
                                                        • Instruction Fuzzy Hash: C0913A37BD563A77D73016A94D0AFAA2954FB84B21F124621BF10FA6C0D396DCC096D2
                                                        Function 008F5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 725 8f5195-8f5243 call 91f8e0 * 2 GetModuleHandleW call 9304f8 call 9306ae call 8f120a 736 8f5259-8f526a call 8f42d7 725->736 737 8f5245 725->737 742 8f526c-8f5271 736->742 743 8f5273-8f528f call 8f5618 CoInitializeEx 736->743 739 8f524a-8f5254 call 930237 737->739 746 8f54d4-8f54db 739->746 742->739 753 8f5298-8f52a4 call 92fcae 743->753 754 8f5291-8f5296 743->754 747 8f54dd-8f54e3 call 935636 746->747 748 8f54e8-8f54ea 746->748 747->748 751 8f54ec-8f54f3 748->751 752 8f54fa-8f5518 call 8fd82f call 90a8d6 call 90ab24 748->752 751->752 755 8f54f5 call 9041ec 751->755 775 8f551a-8f5522 752->775 776 8f5546-8f5559 call 8f4fa4 752->776 762 8f52b8-8f52c7 call 930e07 753->762 763 8f52a6 753->763 754->739 755->752 770 8f52c9-8f52ce 762->770 771 8f52d0-8f52df call 932af7 762->771 765 8f52ab-8f52b3 call 930237 763->765 765->746 770->765 781 8f52e8-8f52f7 call 933565 771->781 782 8f52e1-8f52e6 771->782 775->776 779 8f5524-8f5527 775->779 786 8f555b call 933a35 776->786 787 8f5560-8f5567 776->787 779->776 780 8f5529-8f5544 call 90434c call 8f5602 779->780 780->776 794 8f52f9-8f52fe 781->794 795 8f5300-8f531f GetVersionExW 781->795 782->765 786->787 791 8f556e-8f5575 787->791 792 8f5569 call 932efe 787->792 797 8f557c-8f5583 791->797 798 8f5577 call 931479 791->798 792->791 794->765 802 8f5359-8f539e call 8f33c7 call 8f5602 795->802 803 8f5321-8f532b GetLastError 795->803 799 8f558a-8f558c 797->799 800 8f5585 call 92fdbd 797->800 798->797 807 8f558e CoUninitialize 799->807 808 8f5594-8f559b 799->808 800->799 827 8f53b1-8f53c1 call 90752a 802->827 828 8f53a0-8f53ab call 935636 802->828 809 8f532d-8f5336 803->809 810 8f5338 803->810 807->808 812 8f559d-8f559f 808->812 813 8f55d6-8f55df call 930113 808->813 809->810 814 8f533f-8f5354 call 8f3821 810->814 815 8f533a 810->815 819 8f55a5-8f55ab 812->819 820 8f55a1-8f55a3 812->820 825 8f55e6-8f55ff call 930802 call 91e06f 813->825 826 8f55e1 call 8f45ee 813->826 814->765 815->814 824 8f55ad-8f55c6 call 903d85 call 8f5602 819->824 820->824 824->813 846 8f55c8-8f55d5 call 8f5602 824->846 826->825 840 8f53cd-8f53d6 827->840 841 8f53c3 827->841 828->827 843 8f549e-8f54b4 call 8f4d39 840->843 844 8f53dc-8f53df 840->844 841->840 860 8f54b6 843->860 861 8f54c0-8f54d2 843->861 847 8f5476-8f5489 call 8f4ae5 844->847 848 8f53e5-8f53e8 844->848 846->813 859 8f548e-8f5492 847->859 852 8f544e-8f546a call 8f48ef 848->852 853 8f53ea-8f53ed 848->853 852->861 867 8f546c 852->867 857 8f53ef-8f53f2 853->857 858 8f5426-8f5442 call 8f4a88 853->858 863 8f53f4-8f53f9 857->863 864 8f5403-8f5416 call 8f4c86 857->864 858->861 871 8f5444 858->871 859->861 865 8f5494 859->865 860->861 861->746 863->864 864->861 872 8f541c 864->872 865->843 867->847 871->852 872->858
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 008F5217
                                                          • Part of subcall function 009304F8: InitializeCriticalSection.KERNEL32(0095B5FC,?,008F5223,00000000,?,?,?,?,?,?), ref: 0093050F
                                                          • Part of subcall function 008F120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,008F523F,00000000,?), ref: 008F1248
                                                          • Part of subcall function 008F120A: GetLastError.KERNEL32(?,?,?,008F523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 008F1252
                                                        • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 008F5285
                                                          • Part of subcall function 00930E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00930E28
                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 008F5317
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 008F5321
                                                        • CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008F558E
                                                        Strings
                                                        • Failed to initialize Wiutil., xrefs: 008F52E1
                                                        • Invalid run mode., xrefs: 008F53F9
                                                        • Failed to initialize core., xrefs: 008F53C3
                                                        • Failed to initialize Regutil., xrefs: 008F52C9
                                                        • Failed to initialize Cryputil., xrefs: 008F52A6
                                                        • Failed to initialize user state., xrefs: 008F526C
                                                        • Failed to parse command line., xrefs: 008F5245
                                                        • Failed to run per-machine mode., xrefs: 008F546C
                                                        • Failed to run untrusted mode., xrefs: 008F54B6
                                                        • Failed to get OS info., xrefs: 008F534F
                                                        • Failed to initialize XML util., xrefs: 008F52F9
                                                        • Failed to initialize COM., xrefs: 008F5291
                                                        • Failed to run RunOnce mode., xrefs: 008F541C
                                                        • Failed to run embedded mode., xrefs: 008F5444
                                                        • 3.11.1.2318, xrefs: 008F5384
                                                        • user.cpp, xrefs: 008F5345
                                                        • Failed to run per-user mode., xrefs: 008F5494
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                        • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize user state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$user.cpp
                                                        • API String ID: 3262001429-510904028
                                                        • Opcode ID: 1ff3cfb41169ba92ab7288bd040e6ec65a2e0f94890ed1e257acd6548112fcc9
                                                        • Instruction ID: efa98084b2e26ccc55dbff599270f02de88709990060d2d29c2c428d79c6d108
                                                        • Opcode Fuzzy Hash: 1ff3cfb41169ba92ab7288bd040e6ec65a2e0f94890ed1e257acd6548112fcc9
                                                        • Instruction Fuzzy Hash: ABB18F72D40A2D9BDB21AB74CC56BFE76A5FF98714F0001A5EB08E6241DB709E90CF91
                                                        Function 0090752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 873 90752a-90756f call 91f8e0 call 8f762c 878 907571-907576 873->878 879 90757b-90758c call 8fc407 873->879 880 907814-90781b call 930237 878->880 884 907598-9075a9 call 8fc26e 879->884 885 90758e-907593 879->885 888 90781c-907821 880->888 894 9075b5-9075ca call 8fc4c8 884->894 895 9075ab-9075b0 884->895 885->880 890 907823-907824 call 935636 888->890 891 907829-90782d 888->891 890->891 892 907837-90783c 891->892 893 90782f-907832 call 935636 891->893 898 907844-907851 call 8fc1bb 892->898 899 90783e-90783f call 935636 892->899 893->892 905 9075d6-9075e6 call 91c001 894->905 906 9075cc-9075d1 894->906 895->880 907 907853-907856 call 935636 898->907 908 90785b-90785f 898->908 899->898 914 9075f2-907665 call 905c33 905->914 915 9075e8-9075ed 905->915 906->880 907->908 912 907861-907864 call 935636 908->912 913 907869-90786d 908->913 912->913 917 907877-90787f 913->917 918 90786f-907872 call 8f3a16 913->918 922 907671-907676 914->922 923 907667-90766c 914->923 915->880 918->917 924 907678 922->924 925 90767d-9076b4 call 8f5602 GetCurrentProcess call 930879 call 8f827b 922->925 923->880 924->925 932 9076b6 925->932 933 9076ce-9076e5 call 8f827b 925->933 934 9076bb-9076c9 call 930237 932->934 938 9076e7-9076ec 933->938 939 9076ee-9076f3 933->939 934->888 938->934 941 9076f5-907707 call 8f821f 939->941 942 90774f-907754 939->942 952 907713-907723 call 8f3436 941->952 953 907709-90770e 941->953 943 907774-90777d 942->943 944 907756-907768 call 8f821f 942->944 947 907789-90779d call 90a50c 943->947 948 90777f-907782 943->948 944->943 955 90776a-90776f 944->955 960 9077a6 947->960 961 90779f-9077a4 947->961 948->947 951 907784-907787 948->951 951->947 956 9077ac-9077af 951->956 964 907725-90772a 952->964 965 90772f-907743 call 8f821f 952->965 953->880 955->880 962 9077b1-9077b4 956->962 963 9077b6-9077cc call 8fd5a0 956->963 960->956 961->880 962->888 962->963 969 9077d5-9077e4 call 8fcbc5 963->969 970 9077ce-9077d3 963->970 964->880 965->942 973 907745-90774a 965->973 974 9077e9-9077ed 969->974 970->880 973->880 975 9077f6-90780d call 8fc8e6 974->975 976 9077ef-9077f4 974->976 975->888 979 90780f 975->979 976->880 979->880
                                                        Strings
                                                        • Failed to set source process path variable., xrefs: 00907709
                                                        • Failed to extract bootstrapper application payloads., xrefs: 009077EF
                                                        • Failed to set source process folder variable., xrefs: 00907745
                                                        • Failed to set original source variable., xrefs: 0090776A
                                                        • Failed to parse command line., xrefs: 00907667
                                                        • Failed to get source process folder from path., xrefs: 00907725
                                                        • WixBundleElevated, xrefs: 009076A5, 009076B6
                                                        • Failed to open attached UX container., xrefs: 0090758E
                                                        • Failed to get manifest stream from container., xrefs: 009075CC
                                                        • WixBundleSourceProcessPath, xrefs: 009076F8
                                                        • WixBundleOriginalSource, xrefs: 00907759
                                                        • Failed to initialize variables., xrefs: 00907571
                                                        • WixBundleSourceProcessFolder, xrefs: 00907734
                                                        • Failed to open manifest stream., xrefs: 009075AB
                                                        • Failed to get unique temporary folder for bootstrapper application., xrefs: 009077CE
                                                        • WixBundleUILevel, xrefs: 009076D6, 009076E7
                                                        • Failed to initialize internal cache functionality., xrefs: 0090779F
                                                        • Failed to load catalog files., xrefs: 0090780F
                                                        • Failed to load manifest., xrefs: 009075E8
                                                        • Failed to overwrite the %ls built-in variable., xrefs: 009076BB
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalInitializeSection
                                                        • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                        • API String ID: 32694325-1564579409
                                                        • Opcode ID: bb135b42bff7d575497624ce01b9d906c8c3d711c86b3dcb2dff1403d1e2e6b5
                                                        • Instruction ID: 10166b57355e18457dda91b23745bd89770118aedbfdb03a83b99e010e198239
                                                        • Opcode Fuzzy Hash: bb135b42bff7d575497624ce01b9d906c8c3d711c86b3dcb2dff1403d1e2e6b5
                                                        • Instruction Fuzzy Hash: FAA19272E44A1ABEDB129AE4CC85FEEF76CBB04754F004626FA15E7180D730B944CBA1
                                                        Function 008F762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1085 8f762c-8f7edf InitializeCriticalSection 1086 8f7ee2-8f7f06 call 8f5623 1085->1086 1089 8f7f08-8f7f0f 1086->1089 1090 8f7f13-8f7f24 call 930237 1086->1090 1089->1086 1091 8f7f11 1089->1091 1093 8f7f27-8f7f39 call 91e06f 1090->1093 1091->1093
                                                        APIs
                                                        • InitializeCriticalSection.KERNEL32(0090756B,008F53BD,00000000,008F5445), ref: 008F764C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalInitializeSection
                                                        • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                        • API String ID: 32694325-3635313340
                                                        • Opcode ID: 018fe2fda494f5bec583f864cefaf221d9eb6b61fe907b1237be2c753f2918e6
                                                        • Instruction ID: 7d9bbbd3e40c54bb67dafcc286cbdf445b5b46dcfc2fcbedf10d5a3c9f7c518e
                                                        • Opcode Fuzzy Hash: 018fe2fda494f5bec583f864cefaf221d9eb6b61fe907b1237be2c753f2918e6
                                                        • Instruction Fuzzy Hash: BD3237F1D15B299BDB658F6AC98879DFAF4BB49304F5085EED20CB6210D7B00B888F45
                                                        Function 009082BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1097 9082ba-908303 call 91f8e0 1100 908309-908317 GetCurrentProcess call 930879 1097->1100 1101 90847c-908489 call 8f2195 1097->1101 1105 90831c-908329 1100->1105 1106 908498-9084aa call 91e06f 1101->1106 1107 90848b 1101->1107 1108 9083b7-9083c5 1105->1108 1109 90832f-90833e GetWindowsDirectoryW 1105->1109 1110 908490-908497 call 930237 1107->1110 1122 9083c7-9083d1 GetLastError 1108->1122 1123 9083ff-908411 UuidCreate 1108->1123 1112 908340-90834a GetLastError 1109->1112 1113 908378-908389 call 8f337f 1109->1113 1110->1106 1118 908357 1112->1118 1119 90834c-908355 1112->1119 1127 908395-9083ab call 8f36a3 1113->1127 1128 90838b-908390 1113->1128 1124 908359 1118->1124 1125 90835e-908373 call 8f3821 1118->1125 1119->1118 1131 9083d3-9083dc 1122->1131 1132 9083de 1122->1132 1129 908413-908418 1123->1129 1130 90841a-90842f StringFromGUID2 1123->1130 1124->1125 1125->1110 1127->1123 1144 9083ad-9083b2 1127->1144 1128->1110 1129->1110 1137 908431-90844b call 8f3821 1130->1137 1138 90844d-90846e call 8f1f13 1130->1138 1131->1132 1133 9083e0 1132->1133 1134 9083e5-9083fa call 8f3821 1132->1134 1133->1134 1134->1110 1137->1110 1147 908470-908475 1138->1147 1148 908477 1138->1148 1144->1110 1147->1110 1148->1101
                                                        APIs
                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,008F5489), ref: 00908310
                                                          • Part of subcall function 00930879: OpenProcessToken.ADVAPI32(?,00000008,?,008F53BD,00000000,?,?,?,?,?,?,?,0090769D,00000000), ref: 00930897
                                                          • Part of subcall function 00930879: GetLastError.KERNEL32(?,?,?,?,?,?,?,0090769D,00000000), ref: 009308A1
                                                          • Part of subcall function 00930879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0090769D,00000000), ref: 0093092B
                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00908336
                                                        • GetLastError.KERNEL32 ref: 00908340
                                                        • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 009083BD
                                                        • GetLastError.KERNEL32 ref: 009083C7
                                                        • UuidCreate.RPCRT4(?), ref: 00908406
                                                        Strings
                                                        • Failed to copy working folder path., xrefs: 0090848B
                                                        • Failed to ensure windows path for working folder ended in backslash., xrefs: 0090838B
                                                        • Failed to convert working folder guid into string., xrefs: 00908446
                                                        • Temp\, xrefs: 00908395
                                                        • %ls%ls\, xrefs: 00908458
                                                        • 4#v, xrefs: 009083BD
                                                        • Failed to append bundle id on to temp path for working folder., xrefs: 00908470
                                                        • Failed to get windows path for working folder., xrefs: 0090836E
                                                        • cache.cpp, xrefs: 00908364, 009083EB, 0090843C
                                                        • Failed to concat Temp directory on windows path for working folder., xrefs: 009083AD
                                                        • Failed to get temp path for working folder., xrefs: 009083F5
                                                        • Failed to create working folder guid., xrefs: 00908413
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                        • String ID: 4#v$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                        • API String ID: 266130487-3587817078
                                                        • Opcode ID: 998cceb2628fc214e406888eec5b8f0f55a46bcf55d6612e6e80f057fb6e1d53
                                                        • Instruction ID: c46285135355814e13fe9b1f65c375dc5eed649a82821decff999af9b9e0e77a
                                                        • Opcode Fuzzy Hash: 998cceb2628fc214e406888eec5b8f0f55a46bcf55d6612e6e80f057fb6e1d53
                                                        • Instruction Fuzzy Hash: D241F972F45729ABD73096A58C09FAB73ACAB80B14F000565BB88F7180EE749D044AE6
                                                        Function 009110FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1149 9110fb-911127 CoInitializeEx 1150 911129-911136 call 930237 1149->1150 1151 91113b-911186 call 92f483 1149->1151 1156 91139e-9113b0 call 91e06f 1150->1156 1157 9111b0-9111d2 call 92f4a4 1151->1157 1158 911188-9111ab call 8f3821 call 930237 1151->1158 1166 9111d8-9111e0 1157->1166 1167 91128c-911297 SetEvent 1157->1167 1175 911397-911398 CoUninitialize 1158->1175 1171 9111e6-9111ec 1166->1171 1172 91138f-911392 call 92f4b4 1166->1172 1168 9112d6-9112e4 WaitForSingleObject 1167->1168 1169 911299-9112a3 GetLastError 1167->1169 1178 9112e6-9112f0 GetLastError 1168->1178 1179 911318-911323 ResetEvent 1168->1179 1173 9112b0 1169->1173 1174 9112a5-9112ae 1169->1174 1171->1172 1177 9111f2-9111fa 1171->1177 1172->1175 1180 9112b2 1173->1180 1181 9112b4-9112c4 call 8f3821 1173->1181 1174->1173 1175->1156 1184 911274-911287 call 930237 1177->1184 1185 9111fc-9111fe 1177->1185 1186 9112f2-9112fb 1178->1186 1187 9112fd 1178->1187 1182 911325-91132f GetLastError 1179->1182 1183 91135a-911360 1179->1183 1180->1181 1210 9112c9-9112d1 call 930237 1181->1210 1188 911331-91133a 1182->1188 1189 91133c 1182->1189 1193 911362-911365 1183->1193 1194 91138a 1183->1194 1184->1172 1191 911211-911214 1185->1191 1192 911200 1185->1192 1186->1187 1196 911301-911316 call 8f3821 1187->1196 1197 9112ff 1187->1197 1188->1189 1199 911340-911355 call 8f3821 1189->1199 1200 91133e 1189->1200 1206 911216 1191->1206 1207 91126e 1191->1207 1202 911202-911204 1192->1202 1203 911206-91120f 1192->1203 1204 911367-911381 call 8f3821 1193->1204 1205 911386-911388 1193->1205 1194->1172 1196->1210 1197->1196 1199->1210 1200->1199 1212 911270-911272 1202->1212 1203->1212 1204->1210 1205->1172 1214 911240-911245 1206->1214 1215 911263-911268 1206->1215 1216 911232-911237 1206->1216 1217 911255-91125a 1206->1217 1218 911224-911229 1206->1218 1219 911247-91124c 1206->1219 1220 911239-91123e 1206->1220 1221 91122b-911230 1206->1221 1222 91126a-91126c 1206->1222 1223 91121d-911222 1206->1223 1224 91125c-911261 1206->1224 1225 91124e-911253 1206->1225 1207->1212 1210->1172 1212->1167 1212->1184 1214->1184 1215->1184 1216->1184 1217->1184 1218->1184 1219->1184 1220->1184 1221->1184 1222->1184 1223->1184 1224->1184 1225->1184
                                                        APIs
                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 0091111D
                                                        • CoUninitialize.COMBASE ref: 00911398
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: InitializeUninitialize
                                                        • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 3442037557-1168358783
                                                        • Opcode ID: 54b4d7143b88b05f5c0ad15d3df9d1e1b587f17a5a0bef30bc98e348e403059a
                                                        • Instruction ID: 796845cdf2328397d807ec9b286944b1f10c43a58fa7052bde5b1ab244bce1ef
                                                        • Opcode Fuzzy Hash: 54b4d7143b88b05f5c0ad15d3df9d1e1b587f17a5a0bef30bc98e348e403059a
                                                        • Instruction Fuzzy Hash: 21515B36B9426DF78B2056A48C05EFB3564AB81770B220B65FF31FB290D6798C8096D6
                                                        Function 008F42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1230 8f42d7-8f432e InitializeCriticalSection * 2 call 904d05 * 2 1235 8f4334 1230->1235 1236 8f4452-8f445c call 8fb48b 1230->1236 1237 8f433a-8f4347 1235->1237 1241 8f4461-8f4465 1236->1241 1239 8f434d-8f4379 lstrlenW * 2 CompareStringW 1237->1239 1240 8f4445-8f444c 1237->1240 1244 8f43cb-8f43f7 lstrlenW * 2 CompareStringW 1239->1244 1245 8f437b-8f439e lstrlenW 1239->1245 1240->1236 1240->1237 1242 8f4467-8f4473 call 930237 1241->1242 1243 8f4474-8f447c 1241->1243 1242->1243 1244->1240 1249 8f43f9-8f441c lstrlenW 1244->1249 1246 8f448a-8f449f call 8f3821 1245->1246 1247 8f43a4-8f43a9 1245->1247 1260 8f44a4-8f44ab 1246->1260 1247->1246 1250 8f43af-8f43bf call 8f29ce 1247->1250 1253 8f44b6-8f44d0 call 8f3821 1249->1253 1254 8f4422-8f4427 1249->1254 1263 8f447f-8f4488 1250->1263 1264 8f43c5 1250->1264 1253->1260 1254->1253 1257 8f442d-8f443d call 8f29ce 1254->1257 1257->1263 1268 8f443f 1257->1268 1265 8f44ac-8f44b4 call 930237 1260->1265 1263->1265 1264->1244 1265->1243 1268->1240
                                                        APIs
                                                        • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,008F5266,?,?,00000000,?,?), ref: 008F4303
                                                        • InitializeCriticalSection.KERNEL32(000000D0,?,?,008F5266,?,?,00000000,?,?), ref: 008F430C
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,008F5266,?,?,00000000,?,?), ref: 008F4352
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,008F5266,?,?,00000000,?,?), ref: 008F435C
                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,008F5266,?,?,00000000,?,?), ref: 008F4370
                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,008F5266,?,?,00000000,?,?), ref: 008F4380
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,008F5266,?,?,00000000,?,?), ref: 008F43D0
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,008F5266,?,?,00000000,?,?), ref: 008F43DA
                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,008F5266,?,?,00000000,?,?), ref: 008F43EE
                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,008F5266,?,?,00000000,?,?), ref: 008F43FE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                        • String ID: Failed to initialize user section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$user.cpp
                                                        • API String ID: 3039292287-3209860532
                                                        • Opcode ID: 9d67839e49a22f5671ea9002d605893a51a180536c84ad2bc8619dff5cd068cb
                                                        • Instruction ID: 2f2156500c5f8a579b8c898894c75c296228da36e07681f421d0585dbd32f71c
                                                        • Opcode Fuzzy Hash: 9d67839e49a22f5671ea9002d605893a51a180536c84ad2bc8619dff5cd068cb
                                                        • Instruction Fuzzy Hash: 05519071A44219BEC720DB78CC86FAB7768FF54764F100116F718E7290DB70A950CEA5
                                                        Function 0090E7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1270 90e7b4-90e7f1 1271 90e813-90e834 RegisterClassW 1270->1271 1272 90e7f3-90e807 TlsSetValue 1270->1272 1273 90e836-90e840 GetLastError 1271->1273 1274 90e86e-90e8a5 CreateWindowExW 1271->1274 1272->1271 1275 90e809-90e80e 1272->1275 1276 90e842-90e84b 1273->1276 1277 90e84d 1273->1277 1278 90e8a7-90e8b1 GetLastError 1274->1278 1279 90e8dc-90e8f0 SetEvent 1274->1279 1280 90e93d-90e953 UnregisterClassW 1275->1280 1276->1277 1282 90e854-90e869 call 8f3821 1277->1282 1283 90e84f 1277->1283 1284 90e8b3-90e8bc 1278->1284 1285 90e8be 1278->1285 1281 90e91c-90e927 KiUserCallbackDispatcher 1279->1281 1286 90e8f2-90e8f5 1281->1286 1287 90e929 1281->1287 1296 90e935-90e93c call 930237 1282->1296 1283->1282 1284->1285 1289 90e8c0 1285->1289 1290 90e8c5-90e8da call 8f3821 1285->1290 1291 90e8f7-90e906 IsDialogMessageW 1286->1291 1292 90e92b-90e930 1286->1292 1287->1280 1289->1290 1290->1296 1291->1281 1295 90e908-90e916 TranslateMessage DispatchMessageW 1291->1295 1292->1296 1295->1281 1296->1280
                                                        APIs
                                                        • TlsSetValue.KERNEL32(?,?), ref: 0090E7FF
                                                        • RegisterClassW.USER32(?), ref: 0090E82B
                                                        • GetLastError.KERNEL32 ref: 0090E836
                                                        • CreateWindowExW.USER32(00000080,00949E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0090E89D
                                                        • GetLastError.KERNEL32 ref: 0090E8A7
                                                        • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0090E945
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                        • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                        • API String ID: 213125376-288575659
                                                        • Opcode ID: bc4ac9ea1964849341ea4a85d5fe84af846a8067a48dc91d8776912483b50f63
                                                        • Instruction ID: 576a0a9833123b494679c348133ce4c74e634a28c7a1469b8a53e0788bdd340f
                                                        • Opcode Fuzzy Hash: bc4ac9ea1964849341ea4a85d5fe84af846a8067a48dc91d8776912483b50f63
                                                        • Instruction Fuzzy Hash: FC41A072A05225AFCB208BA4DC45ADFBFB8FF08760F104565FA14FB190E730A900DBA1
                                                        Function 008FC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1300 8fc28f-8fc2c1 1301 8fc32b-8fc347 GetCurrentProcess * 2 DuplicateHandle 1300->1301 1302 8fc2c3-8fc2e1 CreateFileW 1300->1302 1303 8fc349-8fc353 GetLastError 1301->1303 1304 8fc381 1301->1304 1305 8fc2e7-8fc2f1 GetLastError 1302->1305 1306 8fc383-8fc389 1302->1306 1307 8fc355-8fc35e 1303->1307 1308 8fc360 1303->1308 1304->1306 1309 8fc2fe 1305->1309 1310 8fc2f3-8fc2fc 1305->1310 1311 8fc38b-8fc391 1306->1311 1312 8fc393 1306->1312 1307->1308 1313 8fc367-8fc37f call 8f3821 1308->1313 1314 8fc362 1308->1314 1315 8fc305-8fc318 call 8f3821 1309->1315 1316 8fc300 1309->1316 1310->1309 1317 8fc395-8fc3a3 SetFilePointerEx 1311->1317 1312->1317 1331 8fc31d-8fc326 call 930237 1313->1331 1314->1313 1315->1331 1316->1315 1320 8fc3da-8fc3e0 1317->1320 1321 8fc3a5-8fc3af GetLastError 1317->1321 1324 8fc3fe-8fc404 1320->1324 1325 8fc3e2-8fc3e6 call 911741 1320->1325 1322 8fc3bc 1321->1322 1323 8fc3b1-8fc3ba 1321->1323 1328 8fc3be 1322->1328 1329 8fc3c3-8fc3d8 call 8f3821 1322->1329 1323->1322 1334 8fc3eb-8fc3ef 1325->1334 1328->1329 1338 8fc3f6-8fc3fd call 930237 1329->1338 1331->1324 1334->1324 1337 8fc3f1 1334->1337 1337->1338 1338->1324
                                                        APIs
                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,008FC47F,008F5405,?,?,008F5445), ref: 008FC2D6
                                                        • GetLastError.KERNEL32(?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC2E7
                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?), ref: 008FC336
                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC33C
                                                        • DuplicateHandle.KERNELBASE(00000000,?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC33F
                                                        • GetLastError.KERNEL32(?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC349
                                                        • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC39B
                                                        • GetLastError.KERNEL32(?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 008FC3A5
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                        • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                        • API String ID: 2619879409-373955632
                                                        • Opcode ID: 815b842bcf0c6e1f256e15c6b10548ccf72492c347cc7a3e6c3c00f5cf37ac49
                                                        • Instruction ID: afd6ef07ede6a3cd36394b024eb84e7b39f11b3b3de93b37a3f6396b7942277c
                                                        • Opcode Fuzzy Hash: 815b842bcf0c6e1f256e15c6b10548ccf72492c347cc7a3e6c3c00f5cf37ac49
                                                        • Instruction Fuzzy Hash: C741C63664420DABDB209E398E45E2B7AA5FBC4760F218529FB14EB381E731C901DF60
                                                        Function 00932AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1341 932af7-932b17 call 8f3838 1344 932c21-932c25 1341->1344 1345 932b1d-932b2b call 934a6c 1341->1345 1347 932c27-932c2a call 935636 1344->1347 1348 932c2f-932c35 1344->1348 1349 932b30-932b4f GetProcAddress 1345->1349 1347->1348 1351 932b51 1349->1351 1352 932b56-932b6f GetProcAddress 1349->1352 1351->1352 1353 932b71 1352->1353 1354 932b76-932b8f GetProcAddress 1352->1354 1353->1354 1355 932b91 1354->1355 1356 932b96-932baf GetProcAddress 1354->1356 1355->1356 1357 932bb1 1356->1357 1358 932bb6-932bcf GetProcAddress 1356->1358 1357->1358 1359 932bd1 1358->1359 1360 932bd6-932bef GetProcAddress 1358->1360 1359->1360 1361 932bf1 1360->1361 1362 932bf6-932c10 GetProcAddress 1360->1362 1361->1362 1363 932c12 1362->1363 1364 932c17 1362->1364 1363->1364 1364->1344
                                                        APIs
                                                          • Part of subcall function 008F3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 008F3877
                                                          • Part of subcall function 008F3838: GetLastError.KERNEL32 ref: 008F3881
                                                          • Part of subcall function 00934A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00934A9D
                                                        • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00932B41
                                                        • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00932B61
                                                        • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00932B81
                                                        • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00932BA1
                                                        • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00932BC1
                                                        • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00932BE1
                                                        • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00932C01
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ErrorLast$DirectorySystem
                                                        • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                        • API String ID: 2510051996-1735120554
                                                        • Opcode ID: be686b8eb73b28b9dd5fcc7a3867d1b5b7509ecdb15f4f3e0c24701d2b7a74e6
                                                        • Instruction ID: 9268612a1b4be9a6c7cc0b95ad0a7dd963824bd6b10be782dcc85a3d9f939d92
                                                        • Opcode Fuzzy Hash: be686b8eb73b28b9dd5fcc7a3867d1b5b7509ecdb15f4f3e0c24701d2b7a74e6
                                                        • Instruction Fuzzy Hash: F831C27196B308EBDB119F23ED12B69BBB4F75476BF40012AE80456170E7B60849FF54
                                                        Function 0093304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1365 93304f-933073 GetModuleHandleA 1366 933075-93307f GetLastError 1365->1366 1367 9330a8-9330b9 GetProcAddress 1365->1367 1370 933081-93308a 1366->1370 1371 93308c 1366->1371 1368 9330bb-9330df GetProcAddress * 3 1367->1368 1369 9330fc 1367->1369 1372 9330e1-9330e3 1368->1372 1373 9330f8-9330fa 1368->1373 1374 9330fe-93311b CoCreateInstance 1369->1374 1370->1371 1375 933093-9330a3 call 8f3821 1371->1375 1376 93308e 1371->1376 1372->1373 1378 9330e5-9330e7 1372->1378 1373->1374 1379 9331b1-9331b3 1374->1379 1380 933121-933123 1374->1380 1388 9331c7-9331cc 1375->1388 1376->1375 1378->1373 1385 9330e9-9330f6 1378->1385 1382 9331c6 1379->1382 1383 9331b5-9331bc 1379->1383 1381 933128-933138 1380->1381 1386 933142 1381->1386 1387 93313a-93313e 1381->1387 1382->1388 1383->1382 1396 9331be-9331c0 ExitProcess 1383->1396 1385->1374 1391 933144-933154 1386->1391 1387->1381 1389 933140 1387->1389 1392 9331d4-9331d9 1388->1392 1393 9331ce-9331d0 1388->1393 1395 93315c 1389->1395 1397 933166-93316a 1391->1397 1398 933156-93315a 1391->1398 1399 9331e1-9331e8 1392->1399 1400 9331db-9331dd 1392->1400 1393->1392 1395->1397 1401 933195-9331a6 1397->1401 1402 93316c-93317f call 9331eb 1397->1402 1398->1391 1398->1395 1400->1399 1401->1379 1405 9331a8-9331af 1401->1405 1402->1379 1407 933181-933193 1402->1407 1405->1379 1407->1379 1407->1401
                                                        APIs
                                                        • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00933609,00000000,?,00000000), ref: 00933069
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0091C025,?,008F5405,?,00000000,?), ref: 00933075
                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 009330B5
                                                        • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009330C1
                                                        • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 009330CC
                                                        • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009330D6
                                                        • CoCreateInstance.OLE32(0095B6B8,00000000,00000001,0093B818,?,?,?,?,?,?,?,?,?,?,?,0091C025), ref: 00933111
                                                        • ExitProcess.KERNEL32 ref: 009331C0
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                        • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                        • API String ID: 2124981135-499589564
                                                        • Opcode ID: ce88b508870ff3d0be4607ace7eb8b94a6bf4a37bd922a3e3794b2a1992e4ca7
                                                        • Instruction ID: 50061c2a5364051a015a819160f625a32a6ccc42a4337a1493fc5c1b81b75374
                                                        • Opcode Fuzzy Hash: ce88b508870ff3d0be4607ace7eb8b94a6bf4a37bd922a3e3794b2a1992e4ca7
                                                        • Instruction Fuzzy Hash: A741DC35A85315ABDB24DBE9C885BAEB7F8EF44711F118168EE01EB240DB71DE048F90
                                                        Function 00911741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1409 911741-911761 call 8f2195 1412 911763-911768 1409->1412 1413 91176d-91177f CreateEventW 1409->1413 1414 911859-911860 call 930237 1412->1414 1415 911781-91178b GetLastError 1413->1415 1416 9117b9-9117c5 CreateEventW 1413->1416 1431 911861-911867 1414->1431 1418 911798 1415->1418 1419 91178d-911796 1415->1419 1420 9117c7-9117d1 GetLastError 1416->1420 1421 9117fc-911811 CreateThread 1416->1421 1425 91179a 1418->1425 1426 91179f-9117b4 call 8f3821 1418->1426 1419->1418 1427 9117d3-9117dc 1420->1427 1428 9117de 1420->1428 1423 911813-91181d GetLastError 1421->1423 1424 911848-911852 call 9114e1 1421->1424 1432 91182a 1423->1432 1433 91181f-911828 1423->1433 1424->1431 1441 911854 1424->1441 1425->1426 1426->1414 1427->1428 1429 9117e0 1428->1429 1430 9117e5-9117fa call 8f3821 1428->1430 1429->1430 1430->1414 1437 911831-911846 call 8f3821 1432->1437 1438 91182c 1432->1438 1433->1432 1437->1414 1438->1437 1441->1414
                                                        APIs
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,008FC3EB,?,00000000,?,008FC47F), ref: 00911778
                                                        • GetLastError.KERNEL32(?,008FC3EB,?,00000000,?,008FC47F,008F5405,?,?,008F5445,008F5445,00000000,?,00000000), ref: 00911781
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateErrorEventLast
                                                        • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                        • API String ID: 545576003-938279966
                                                        • Opcode ID: d75d8d00648434496a6fe70090e37182f83e17ea5affd31fef6bbb57fddab27a
                                                        • Instruction ID: b041f8c5b8897b47d7ac099f43c99586559df510cafd017b4fb8f258a7b9d067
                                                        • Opcode Fuzzy Hash: d75d8d00648434496a6fe70090e37182f83e17ea5affd31fef6bbb57fddab27a
                                                        • Instruction Fuzzy Hash: 19212977F9163E77E32116A54C45FAB695CEB40BB4B024221BF00FB280E764DC4086E1
                                                        Function 0092FCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0092FCD6
                                                        • GetProcAddress.KERNEL32(SystemFunction041), ref: 0092FCE8
                                                        • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0092FD2B
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0092FD3F
                                                        • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0092FD77
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0092FD8B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AddressProc$ErrorLast
                                                        • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                        • API String ID: 4214558900-3191127217
                                                        • Opcode ID: f48f1c345b384fb7979fe351198b5ad4c128867c56b904231bbdb70dbe785bce
                                                        • Instruction ID: 26c068518f30a237ea4beb97078d85e8c02a3a23e7340016c708d20f8d4271aa
                                                        • Opcode Fuzzy Hash: f48f1c345b384fb7979fe351198b5ad4c128867c56b904231bbdb70dbe785bce
                                                        • Instruction Fuzzy Hash: BB2180329693369BC7259B67BD15B166AA4EB40B97F120271FD00AB2A4F7748C01BBD0
                                                        Function 009108C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 009108F2
                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0091090A
                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 0091090F
                                                        • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00910912
                                                        • GetLastError.KERNEL32(?,?), ref: 0091091C
                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0091098B
                                                        • GetLastError.KERNEL32(?,?), ref: 00910998
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00910940, 009109BC
                                                        • <the>.cab, xrefs: 009108EB
                                                        • Failed to add virtual file pointer for cab container., xrefs: 00910971
                                                        • Failed to open cabinet file: %hs, xrefs: 009109C9
                                                        • Failed to duplicate handle to cab container., xrefs: 0091094A
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                        • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                        • API String ID: 3030546534-3446344238
                                                        • Opcode ID: c597878092d83e26f1368d65b7b1b9f0df34a3ffb54880b192a94473053e53e6
                                                        • Instruction ID: c9e52aaeb5d8dc796424b9c307a6ca39c0530f440c622dcebfcd851219113158
                                                        • Opcode Fuzzy Hash: c597878092d83e26f1368d65b7b1b9f0df34a3ffb54880b192a94473053e53e6
                                                        • Instruction Fuzzy Hash: 9931F432A45239BBEB215B958C19F9F7E6CFF84760F110211FE04B7280D7619C809BE1
                                                        Function 00903F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00903AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00903FB5,feclient.dll,?,00000000,?,?,?,008F4B12), ref: 00903B42
                                                        • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,008F4B12,?,?,0093B488,?,00000001,00000000,00000000), ref: 0090404C
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseSleep
                                                        • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                        • API String ID: 2834455192-2673269691
                                                        • Opcode ID: 6bf95dcb0dac200b88f41c7382e64b230e45d77546e7c94525093cd587acd5ef
                                                        • Instruction ID: ba03f2f36614206deec31b80d2613500354d60b35236ad28c4a4afc119175205
                                                        • Opcode Fuzzy Hash: 6bf95dcb0dac200b88f41c7382e64b230e45d77546e7c94525093cd587acd5ef
                                                        • Instruction Fuzzy Hash: 70619EB1A04619AEDB219B74CC42B7A77BCEF64340F048565FE00EB180E770ED909B91
                                                        Function 008F6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(00000001,?,00000000,008F5445,00000006,?,008F82B9,?,?,?,00000000,00000000,00000001), ref: 008F6DC8
                                                          • Part of subcall function 008F56A9: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,008F6595,008F6595,?,008F563D,?,?,00000000), ref: 008F56E5
                                                          • Part of subcall function 008F56A9: GetLastError.KERNEL32(?,008F563D,?,?,00000000,?,?,008F6595,?,008F7F02,?,?,?,?,?), ref: 008F5714
                                                        • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,008F82B9), ref: 008F6F59
                                                        Strings
                                                        • Failed to set value of variable: %ls, xrefs: 008F6F41
                                                        • Setting numeric variable '%ls' to value %lld, xrefs: 008F6EFA
                                                        • Setting string variable '%ls' to value '%ls', xrefs: 008F6EED
                                                        • Unsetting variable '%ls', xrefs: 008F6F15
                                                        • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 008F6F6B
                                                        • Failed to find variable value '%ls'., xrefs: 008F6DE3
                                                        • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 008F6ED0
                                                        • Setting hidden variable '%ls', xrefs: 008F6E86
                                                        • Failed to insert variable '%ls'., xrefs: 008F6E0D
                                                        • variable.cpp, xrefs: 008F6E4B
                                                        • Attempt to set built-in variable value: %ls, xrefs: 008F6E56
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                        • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                        • API String ID: 2716280545-445000439
                                                        • Opcode ID: 98a00bb5dbebdf855dad6b3f4a66bd84ff02b9bff8dde6f351981c632983e635
                                                        • Instruction ID: c339d3c5af85f14d60f7f229622cb25dfcba86f5016a060e738e400df816e09d
                                                        • Opcode Fuzzy Hash: 98a00bb5dbebdf855dad6b3f4a66bd84ff02b9bff8dde6f351981c632983e635
                                                        • Instruction Fuzzy Hash: CC51C772A4021DA7DB309E35DC4AF773BA8FB95718F200219FA45E6281E671DD60CFA1
                                                        Function 008F4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • IsWindow.USER32(?), ref: 008F4C64
                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 008F4C75
                                                        Strings
                                                        • Failed to set registration variables., xrefs: 008F4BDE
                                                        • Failed to set layout directory variable to value provided from command-line., xrefs: 008F4C06
                                                        • Failed to query registration., xrefs: 008F4BAE
                                                        • Failed to set action variables., xrefs: 008F4BC4
                                                        • Failed to check global conditions, xrefs: 008F4B49
                                                        • Failed to open log., xrefs: 008F4B18
                                                        • Failed while running , xrefs: 008F4C2A
                                                        • WixBundleLayoutDirectory, xrefs: 008F4BF5
                                                        • Failed to create the message window., xrefs: 008F4B98
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: MessagePostWindow
                                                        • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                        • API String ID: 3618638489-3051724725
                                                        • Opcode ID: 78aed2a2a361d7a5f3f7372437d0c5912c93935d0f0004c113f3b1ec1c46de3f
                                                        • Instruction ID: 02b6108d0acb6bada7a5845b0b3035fff2e2e4a5ce2c090092912a1f8b5ae01b
                                                        • Opcode Fuzzy Hash: 78aed2a2a361d7a5f3f7372437d0c5912c93935d0f0004c113f3b1ec1c46de3f
                                                        • Instruction Fuzzy Hash: 8741F27160161FBBCB265A74CC45FBBB66CFB40768F006216BB14E2181EBB0ED109AE0
                                                        Function 008F2DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 008F2E5F
                                                        • GetLastError.KERNEL32 ref: 008F2E69
                                                        • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 008F2F09
                                                        • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 008F2F96
                                                        • GetLastError.KERNEL32 ref: 008F2FA3
                                                        • Sleep.KERNEL32(00000064), ref: 008F2FB7
                                                        • CloseHandle.KERNEL32(?), ref: 008F301F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                        • String ID: 4#v$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                        • API String ID: 3480017824-1777530710
                                                        • Opcode ID: 93b55b008f791168f511bc49d27886a0e5043581542bed457b634c68d04048a3
                                                        • Instruction ID: 7560926592c4d1c61c3b8b1998afe333ec8e24a032bb6488d331180bc7c2e059
                                                        • Opcode Fuzzy Hash: 93b55b008f791168f511bc49d27886a0e5043581542bed457b634c68d04048a3
                                                        • Instruction Fuzzy Hash: 35716472D5162DABDB319FA49C49BBAB3B8FB48710F100195FB04E7191DB349E809FA1
                                                        Function 0090EA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,008F548E,?,?), ref: 0090EA9D
                                                        • GetLastError.KERNEL32(?,008F548E,?,?), ref: 0090EAAA
                                                        • CreateThread.KERNELBASE(00000000,00000000,Function_0001E7B4,?,00000000,00000000), ref: 0090EB03
                                                        • GetLastError.KERNEL32(?,008F548E,?,?), ref: 0090EB10
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,008F548E,?,?), ref: 0090EB4B
                                                        • CloseHandle.KERNEL32(00000000,?,008F548E,?,?), ref: 0090EB6A
                                                        • CloseHandle.KERNELBASE(?,?,008F548E,?,?), ref: 0090EB77
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                        • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                        • API String ID: 2351989216-3599963359
                                                        • Opcode ID: 92283c3a5ed40770b3846642428704eaaef7e106fd1c472942e031d48c0a1f0e
                                                        • Instruction ID: b0ca9eb8674f15b9315808d3b13aa6a329eb10f7fc01738e1155c09c77b4a642
                                                        • Opcode Fuzzy Hash: 92283c3a5ed40770b3846642428704eaaef7e106fd1c472942e031d48c0a1f0e
                                                        • Instruction Fuzzy Hash: 8D31B776E01229BFD710DFA98D85AAFBABCFF44750F110565FA15F7280E7309E008AA1
                                                        Function 009114E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,76232F60,?,?,008F5405,008F53BD,00000000,008F5445), ref: 00911506
                                                        • GetLastError.KERNEL32 ref: 00911519
                                                        • GetExitCodeThread.KERNELBASE(0093B488,?), ref: 0091155B
                                                        • GetLastError.KERNEL32 ref: 00911569
                                                        • ResetEvent.KERNEL32(0093B460), ref: 009115A4
                                                        • GetLastError.KERNEL32 ref: 009115AE
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                        • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                        • API String ID: 2979751695-3400260300
                                                        • Opcode ID: 9f7bfad16cf3e8119582625b0aeb78b8fd4e374cec1130f160b6c69cbbb74ae4
                                                        • Instruction ID: f2a33ddbe3cd52c6610029a86a306f1e98c2a50b2a8612006cb2a89c47de373c
                                                        • Opcode Fuzzy Hash: 9f7bfad16cf3e8119582625b0aeb78b8fd4e374cec1130f160b6c69cbbb74ae4
                                                        • Instruction Fuzzy Hash: C131B471B54209FBE7109F698D05AEF7BFDFB84710B10416AFB06D6160E734CA40AB61
                                                        Function 008FCBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,008F53BD,00000000,008F5489,008F5445,WixBundleUILevel,840F01E8,?,00000001), ref: 008FCC1C
                                                        Strings
                                                        • Failed to get directory portion of local file path, xrefs: 008FCCF5
                                                        • payload.cpp, xrefs: 008FCD1D
                                                        • Failed to concat file paths., xrefs: 008FCCFC
                                                        • Failed to get next stream., xrefs: 008FCD03
                                                        • Failed to extract file., xrefs: 008FCCE7
                                                        • Failed to ensure directory exists, xrefs: 008FCCEE
                                                        • Failed to find embedded payload: %ls, xrefs: 008FCC48
                                                        • Payload was not found in container: %ls, xrefs: 008FCD29
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareString
                                                        • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                        • API String ID: 1825529933-1711239286
                                                        • Opcode ID: 01179f7199cc21df569515fa0f2efa23ec893c76e1af81a34e232f60cc4f69e8
                                                        • Instruction ID: b55cdc8d8f36c7f7445791e737fab311e1df3de9814366f90c08780910752133
                                                        • Opcode Fuzzy Hash: 01179f7199cc21df569515fa0f2efa23ec893c76e1af81a34e232f60cc4f69e8
                                                        • Instruction Fuzzy Hash: ED41CF31D4021DABCF25AF68CE819BEBB65FF40714F118169EA15EB261D3709E40DF91
                                                        Function 008F4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 008F47BB
                                                        • GetCurrentThreadId.KERNEL32 ref: 008F47C1
                                                        • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 008F484F
                                                        Strings
                                                        • Failed to start bootstrapper application., xrefs: 008F481D
                                                        • Failed to load UX., xrefs: 008F4804
                                                        • Failed to create user for UX., xrefs: 008F47DB
                                                        • wininet.dll, xrefs: 008F47EE
                                                        • Unexpected return value from message pump., xrefs: 008F48A5
                                                        • user.cpp, xrefs: 008F489B
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Message$CurrentPeekThread
                                                        • String ID: Failed to create user for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$user.cpp$wininet.dll
                                                        • API String ID: 673430819-2573580774
                                                        • Opcode ID: a800f988fb81689b36586e099f1f8a2affc0727860bb876f62f9cb1b686cc8a2
                                                        • Instruction ID: 385acda50865cb8d147f52526e84a37765665344d423d581d99363245bca30da
                                                        • Opcode Fuzzy Hash: a800f988fb81689b36586e099f1f8a2affc0727860bb876f62f9cb1b686cc8a2
                                                        • Instruction Fuzzy Hash: 14418F71A1065DBFDB149AB4CC85EBBB7ACFB44358F100126FB04E7190DB24AD058BA1
                                                        Function 008FD6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,008F47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,008F548E,?), ref: 008FD6DA
                                                        • GetLastError.KERNEL32(?,008F47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,008F548E,?,?), ref: 008FD6E7
                                                        • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 008FD71F
                                                        • GetLastError.KERNEL32(?,008F47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,008F548E,?,?), ref: 008FD72B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$AddressLibraryLoadProc
                                                        • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                        • API String ID: 1866314245-2276003667
                                                        • Opcode ID: ce1d52b7476ca725142996f8a0281205df0b5a3a0a4ec212111b2d05f46c03b3
                                                        • Instruction ID: f40c9705a551d25f9dc81e63bef8da73adb5e6f2637e9b935e6636cdbc43a060
                                                        • Opcode Fuzzy Hash: ce1d52b7476ca725142996f8a0281205df0b5a3a0a4ec212111b2d05f46c03b3
                                                        • Instruction Fuzzy Hash: 1F11C137A85B3AA7CB2166A59C15F2B6A94FB45B65F010525FF50FF280EB20DC008EE0
                                                        Function 008FF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 008FF942
                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 008FF94F
                                                        Strings
                                                        • %ls.RebootRequired, xrefs: 008FF82F
                                                        • Failed to format pending restart registry key to read., xrefs: 008FF846
                                                        • Failed to read Resume value., xrefs: 008FF8D8
                                                        • Failed to open registration key., xrefs: 008FF8AB
                                                        • Resume, xrefs: 008FF8B6
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Close
                                                        • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                        • API String ID: 3535843008-3890505273
                                                        • Opcode ID: 10c42a72a85010fa74471d03e30b678f7f0688df0de2e956fc2dc11cb5a67dab
                                                        • Instruction ID: e0d268a345d369c21456a4a27af3aacd4dd0910511894c39ed24f8585b497a67
                                                        • Opcode Fuzzy Hash: 10c42a72a85010fa74471d03e30b678f7f0688df0de2e956fc2dc11cb5a67dab
                                                        • Instruction Fuzzy Hash: 9E411A71A4011DFBCB119EB8C881BBDBBA8FF44314F154176EB14EB262C3B19E519B50
                                                        Function 6CFE0948 Relevance: 12.1, APIs: 8, Instructions: 136COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • __RTC_Initialize.LIBCMT ref: 6CFE098F
                                                        • ___scrt_uninitialize_crt.LIBCMT ref: 6CFE09A9
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Initialize___scrt_uninitialize_crt
                                                        • String ID:
                                                        • API String ID: 2442719207-0
                                                        • Opcode ID: 8f244c7c8a73d9407b7d5cbdf3463ed930e9a1c8c9a46282b8eeaf7673cbacc0
                                                        • Instruction ID: b3c473d949121f3d00794130f1527c0aa00bdc34c7f83e7997b9e01765cdd7dd
                                                        • Opcode Fuzzy Hash: 8f244c7c8a73d9407b7d5cbdf3463ed930e9a1c8c9a46282b8eeaf7673cbacc0
                                                        • Instruction Fuzzy Hash: 9641E572D052A8FFDB209F55CC40BEE3AB5EB89B58F11411AE414A7B50CFB08945ABA0
                                                        Function 00930523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • EnterCriticalSection.KERNEL32(0095B5FC,00000000,?,?,?,00904207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,008F54FA,?), ref: 00930533
                                                        • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0095B5F4,?,00904207,00000000,Setup), ref: 009305D7
                                                        • GetLastError.KERNEL32(?,00904207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,008F54FA,?,?,?), ref: 009305E7
                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00904207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,008F54FA,?), ref: 00930621
                                                          • Part of subcall function 008F2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 008F2F09
                                                        • LeaveCriticalSection.KERNEL32(0095B5FC,?,?,0095B5F4,?,00904207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,008F54FA,?), ref: 0093067A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                        • String ID: logutil.cpp
                                                        • API String ID: 4111229724-3545173039
                                                        • Opcode ID: c956c3e97bd7935dfbcdcbc37ce0a6c39b52a1f8a21b781a340ad8eb712cc347
                                                        • Instruction ID: 331e6c8a0c59662eb8fbf94fd5a9687bb4ba1778d3bd152c3b6ce02aac40c869
                                                        • Opcode Fuzzy Hash: c956c3e97bd7935dfbcdcbc37ce0a6c39b52a1f8a21b781a340ad8eb712cc347
                                                        • Instruction Fuzzy Hash: F431B17191432EEBDB119FA69D66E6E766CEB80759F010225FF00A6160D770CD60AFA0
                                                        Function 00910B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00910C2B
                                                        • Failed to write during cabinet extraction., xrefs: 00910C35
                                                        • Unexpected call to CabWrite()., xrefs: 00910BC1
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastWrite_memcpy_s
                                                        • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                        • API String ID: 1970631241-3111339858
                                                        • Opcode ID: 50ab76d21bcc7822bba5663f849e70bdc5d5f7311f4e6143d5e3e5e87420d2ba
                                                        • Instruction ID: 555a88c3566b1b7496976dffb922bdf8bbfbecc32449be05e60f9784e56d15b8
                                                        • Opcode Fuzzy Hash: 50ab76d21bcc7822bba5663f849e70bdc5d5f7311f4e6143d5e3e5e87420d2ba
                                                        • Instruction Fuzzy Hash: 4D210176644208ABCB10CF6CC985DAA37ADFFC4320B214259FE14C7241E6B2D980CFA0
                                                        Function 00930879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • OpenProcessToken.ADVAPI32(?,00000008,?,008F53BD,00000000,?,?,?,?,?,?,?,0090769D,00000000), ref: 00930897
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,0090769D,00000000), ref: 009308A1
                                                        • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,0090769D,00000000), ref: 009308D3
                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,0090769D,00000000), ref: 009308EC
                                                        • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0090769D,00000000), ref: 0093092B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                        • String ID: procutil.cpp
                                                        • API String ID: 4040495316-1178289305
                                                        • Opcode ID: 178b4a8eeac8cc7294d0380e23cb40b3f91609be252ced82c2dcca370b10aeec
                                                        • Instruction ID: 4f81b2d2555877aad6a5069c52bfcf6aaba6be565f289985a34c476dd23893fc
                                                        • Opcode Fuzzy Hash: 178b4a8eeac8cc7294d0380e23cb40b3f91609be252ced82c2dcca370b10aeec
                                                        • Instruction Fuzzy Hash: 2321C632D44229EBE7259B998815B9EBBBCEF94711F114166EE15FB250D3708E00EFD0
                                                        Function 00910C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00910CC4
                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00910CD6
                                                        • SetFileTime.KERNELBASE(?,?,?,?), ref: 00910CE9
                                                        • CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,009108B1,?,?), ref: 00910CF8
                                                        Strings
                                                        • Invalid operation for this state., xrefs: 00910C9D
                                                        • cabextract.cpp, xrefs: 00910C93
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Time$File$CloseDateHandleLocal
                                                        • String ID: Invalid operation for this state.$cabextract.cpp
                                                        • API String ID: 609741386-1751360545
                                                        • Opcode ID: 5135040f12d68a05d479b1f9accf579d708eb48aa8363789ff4f43cf49027c4a
                                                        • Instruction ID: 5a41a6a63b96319fa12a983db140e4dd78c97116a95fc9ebb49478815ca0e8a2
                                                        • Opcode Fuzzy Hash: 5135040f12d68a05d479b1f9accf579d708eb48aa8363789ff4f43cf49027c4a
                                                        • Instruction Fuzzy Hash: 2521F37291061EAB87109FA8DD099FABBACFF843207108316F964D61D0D3B5E991CFD0
                                                        Function 00933565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CoInitialize.OLE32(00000000), ref: 00933574
                                                        • InterlockedIncrement.KERNEL32(0095B6C8), ref: 00933591
                                                        • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0095B6B8,?,?,?,?,?,?), ref: 009335AC
                                                        • CLSIDFromProgID.OLE32(MSXML.DOMDocument,0095B6B8,?,?,?,?,?,?), ref: 009335B8
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FromProg$IncrementInitializeInterlocked
                                                        • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                        • API String ID: 2109125048-2356320334
                                                        • Opcode ID: aac4419bd9c1f0da4a86c21a03eed4c15b4086dc3c607c3b59dacaddcc4e070f
                                                        • Instruction ID: 58a7a50f3131aaf1153b796abe6beba6665951a85ea465454d21d819a95430d5
                                                        • Opcode Fuzzy Hash: aac4419bd9c1f0da4a86c21a03eed4c15b4086dc3c607c3b59dacaddcc4e070f
                                                        • Instruction Fuzzy Hash: 58F0E5317C63395BC3205B63BD08B1B2DA9EBC0B6AF000529FD08C2064D360C9458FB0
                                                        Function 00934A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00934A9D
                                                        • GlobalAlloc.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00934ACA
                                                        • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00934AF6
                                                        • GetLastError.KERNEL32(00000000,0093B7A0,?,00000000,?,00000000,?,00000000), ref: 00934B34
                                                        • GlobalFree.KERNEL32(00000000), ref: 00934B65
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$Global$AllocFree
                                                        • String ID: fileutil.cpp
                                                        • API String ID: 1145190524-2967768451
                                                        • Opcode ID: 844488329d7dec204766aea52bac2e6040ff496968842264f0fc264a04ee0e50
                                                        • Instruction ID: 3f4ac30756d00a8b50b833167a42f59868c08f91f3d2ce71d6b8c05232d60b69
                                                        • Opcode Fuzzy Hash: 844488329d7dec204766aea52bac2e6040ff496968842264f0fc264a04ee0e50
                                                        • Instruction Fuzzy Hash: AF318637D44229ABC7119A998C41FAFFAB8EF84750F124265FD14E7241D734ED009EE5
                                                        Function 0090E956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • DefWindowProcW.USER32(?,00000082,?,?), ref: 0090E985
                                                        • SetWindowLongW.USER32(?,000000EB,00000000), ref: 0090E994
                                                        • SetWindowLongW.USER32(?,000000EB,?), ref: 0090E9A8
                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 0090E9B8
                                                        • GetWindowLongW.USER32(?,000000EB), ref: 0090E9D2
                                                        • PostQuitMessage.USER32(00000000), ref: 0090EA31
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Window$Long$Proc$MessagePostQuit
                                                        • String ID:
                                                        • API String ID: 3812958022-0
                                                        • Opcode ID: 9317d2083cf67bf7371f27cb035ead134ec62439f5a7f4186fe7fe4585c27f3a
                                                        • Instruction ID: 7b4e8b9361ae4ba20d1912dfd62e4070ff28e5a6e0aeaafc0a5ac2082b168786
                                                        • Opcode Fuzzy Hash: 9317d2083cf67bf7371f27cb035ead134ec62439f5a7f4186fe7fe4585c27f3a
                                                        • Instruction Fuzzy Hash: 6D219876204114BFDF159F68DC49E6A3B6AFF89311F148A18FA1A9A1E4C731DD10EB90
                                                        Function 00910A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00910B27
                                                        • GetLastError.KERNEL32(?,?,?), ref: 00910B31
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00910B55
                                                        • Failed to move file pointer 0x%x bytes., xrefs: 00910B62
                                                        • Invalid seek type., xrefs: 00910ABD
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                        • API String ID: 2976181284-417918914
                                                        • Opcode ID: a89cb5d2edf6b9e876b90e6b9ebc86a17bd1939d4bb7274de7672cd5a63956c9
                                                        • Instruction ID: a2ae331c3a10a73d21464e2dc8cb67c2070dae3a19e7437a662422e8c01a0922
                                                        • Opcode Fuzzy Hash: a89cb5d2edf6b9e876b90e6b9ebc86a17bd1939d4bb7274de7672cd5a63956c9
                                                        • Instruction Fuzzy Hash: 0B31C131B8021EEFCB10DFA8C884EAEB769FF84724B048215F92497250D371ED908B90
                                                        Function 008F4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,0090A0E8,00000000,00000000,?,00000000,008F53BD,00000000,?,?,008FD5B5,?), ref: 008F4123
                                                        • GetLastError.KERNEL32(?,0090A0E8,00000000,00000000,?,00000000,008F53BD,00000000,?,?,008FD5B5,?,00000000,00000000), ref: 008F4131
                                                        • CreateDirectoryW.KERNEL32(?,840F01E8,008F5489,?,0090A0E8,00000000,00000000,?,00000000,008F53BD,00000000,?,?,008FD5B5,?,00000000), ref: 008F419A
                                                        • GetLastError.KERNEL32(?,0090A0E8,00000000,00000000,?,00000000,008F53BD,00000000,?,?,008FD5B5,?,00000000,00000000), ref: 008F41A4
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CreateDirectoryErrorLast
                                                        • String ID: dirutil.cpp
                                                        • API String ID: 1375471231-2193988115
                                                        • Opcode ID: b65e9d503a83c12c16fb73b65f0240f107711f2d04cf0ded5a1e7e364760a57f
                                                        • Instruction ID: 78652ff608953eddf19c190262aff9638c94bec27fbbb5e5930c89bd19095c81
                                                        • Opcode Fuzzy Hash: b65e9d503a83c12c16fb73b65f0240f107711f2d04cf0ded5a1e7e364760a57f
                                                        • Instruction Fuzzy Hash: 1111D22660433D96D7311AB54C40B7BB668FF75B65F115023FF05EA250E3658CD09691
                                                        Function 6CFE09F8 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: dllmain_raw$dllmain_crt_dispatch
                                                        • String ID:
                                                        • API String ID: 3136044242-0
                                                        • Opcode ID: 41fe25a402130edf0ee5c9660f8d2eae79e44f504fefab82ec3b1cdd0b483d87
                                                        • Instruction ID: 1bf7cc39a89876d1d9055a4b4b78924b6ca7914acb842029dddb6787c4a4a1bb
                                                        • Opcode Fuzzy Hash: 41fe25a402130edf0ee5c9660f8d2eae79e44f504fefab82ec3b1cdd0b483d87
                                                        • Instruction Fuzzy Hash: 92217472D011ADFFDB259F55CC40EAF3A79EB89F98F014116F81457650CBB08D42ABA0
                                                        Function 6CFD6EF9 Relevance: 7.6, APIs: 5, Instructions: 68sleepprocessCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetModuleHandleW.KERNEL32 ref: 6CFD6F0A
                                                        • GetModuleFileNameW.KERNEL32(?,00000104), ref: 6CFD6F22
                                                        • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6CFD6FB7
                                                        • Sleep.KERNELBASE ref: 6CFD6FC3
                                                        • ExitProcess.KERNEL32 ref: 6CFD6FCA
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ModuleProcess$CreateExitFileHandleNameSleep
                                                        • String ID:
                                                        • API String ID: 1732164044-0
                                                        • Opcode ID: b79c44222715e3c9055c2ca9ee17fe2ee8dc6fd2c64b47e1a068ece2d43c6c38
                                                        • Instruction ID: 9bbbfc7a5a77b2481cb145dab67e15c5cbfee56fd10aa90239b32a3b6a851ef5
                                                        • Opcode Fuzzy Hash: b79c44222715e3c9055c2ca9ee17fe2ee8dc6fd2c64b47e1a068ece2d43c6c38
                                                        • Instruction Fuzzy Hash: 7221AF72910118AACB11EF98EC44FAF73BCFB49744F15096AF616E70A0E77069548B58
                                                        Function 00903AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00930F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0095AAA0,00000000,?,009357E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00930F80
                                                        • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00903FB5,feclient.dll,?,00000000,?,?,?,008F4B12), ref: 00903B42
                                                          • Part of subcall function 009310B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0093112B
                                                          • Part of subcall function 009310B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00931163
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: QueryValue$CloseOpen
                                                        • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                        • API String ID: 1586453840-3596319545
                                                        • Opcode ID: adaec0783c7189ff0c791ce64c3fb7ecad79cafb8c61e503672c07456be4d0c6
                                                        • Instruction ID: dacd5fc3d21f23b2fe57b94f12bea2dcba8766f32257dd1613e44c0af470c8ab
                                                        • Opcode Fuzzy Hash: adaec0783c7189ff0c791ce64c3fb7ecad79cafb8c61e503672c07456be4d0c6
                                                        • Instruction Fuzzy Hash: 2111B232B40208BFDB21DB95DC82EBBBBBCEB54708F9080A5E500AB0D1D6719F81D750
                                                        Function 00930764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenA.KERNEL32(0090E93B,00000000,00000000,?,?,?,00930013,0090E93B,0090E93B,?,00000000,0000FDE9,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 00930776
                                                        • WriteFile.KERNELBASE(00000200,00000000,00000000,?,00000000,?,?,00930013,0090E93B,0090E93B,?,00000000,0000FDE9,?,0090E93B,8000FFFF), ref: 009307B2
                                                        • GetLastError.KERNEL32(?,?,00930013,0090E93B,0090E93B,?,00000000,0000FDE9,?,0090E93B,8000FFFF,Unexpected return value from message pump.), ref: 009307BC
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastWritelstrlen
                                                        • String ID: logutil.cpp
                                                        • API String ID: 606256338-3545173039
                                                        • Opcode ID: 54dcd2f3a885918094f7ff01c3913da984c02ae4a77646e7e73150658b968442
                                                        • Instruction ID: c7c7031a25fea1b40b95150d6cb1c7038a9e36bc2e40d6ec0d2d0c60af68423d
                                                        • Opcode Fuzzy Hash: 54dcd2f3a885918094f7ff01c3913da984c02ae4a77646e7e73150658b968442
                                                        • Instruction Fuzzy Hash: 28118A72A45229AB87109A6A9D549ABBA6CFBC4761F110224FE06E7240E770AD00DEE1
                                                        Function 009109EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 0091140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00910A19,?,?,?), ref: 00911434
                                                          • Part of subcall function 0091140C: GetLastError.KERNEL32(?,00910A19,?,?,?), ref: 0091143E
                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00910A27
                                                        • GetLastError.KERNEL32 ref: 00910A31
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00910A55
                                                        • Failed to read during cabinet extraction., xrefs: 00910A5F
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLast$PointerRead
                                                        • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                        • API String ID: 2170121939-2426083571
                                                        • Opcode ID: 02e61be287f0987454d97eaa8c24b6a7d991f5bb372195a02d70ee8030672bd9
                                                        • Instruction ID: 0fc88cd22cf5ee329757edd2d2e81b08952ebb38d9ac31c19884f27fd3c8f816
                                                        • Opcode Fuzzy Hash: 02e61be287f0987454d97eaa8c24b6a7d991f5bb372195a02d70ee8030672bd9
                                                        • Instruction Fuzzy Hash: 6611CE36A4022DBBCB219F95DC08E9A7B68FF84760B014255FE04A7290C7319950DBE0
                                                        Function 0091140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00910A19,?,?,?), ref: 00911434
                                                        • GetLastError.KERNEL32(?,00910A19,?,?,?), ref: 0091143E
                                                        Strings
                                                        • cabextract.cpp, xrefs: 00911462
                                                        • Failed to move to virtual file pointer., xrefs: 0091146C
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileLastPointer
                                                        • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                        • API String ID: 2976181284-3005670968
                                                        • Opcode ID: 4a34a42f1cb1a1a8180abcf1b6d044c2354f5fd156847ae75d87581b4f0d5dc6
                                                        • Instruction ID: 625f8a558f8430f7c923ee1e62cfb09b505d48b240a574dba8cbd0ecbc87f9fc
                                                        • Opcode Fuzzy Hash: 4a34a42f1cb1a1a8180abcf1b6d044c2354f5fd156847ae75d87581b4f0d5dc6
                                                        • Instruction Fuzzy Hash: 7901D4376406397787214A958C04E8BBF18EF40BB07118125FF2896190D7319850CAD0
                                                        Function 009107B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SetEvent.KERNEL32(0093B478,00000000,?,00911717,?,00000000,?,008FC287,?,008F5405,?,009075A5,?,?,008F5405,?), ref: 009107BF
                                                        • GetLastError.KERNEL32(?,00911717,?,00000000,?,008FC287,?,008F5405,?,009075A5,?,?,008F5405,?,008F5445,00000001), ref: 009107C9
                                                        Strings
                                                        • cabextract.cpp, xrefs: 009107ED
                                                        • Failed to set begin operation event., xrefs: 009107F7
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorEventLast
                                                        • String ID: Failed to set begin operation event.$cabextract.cpp
                                                        • API String ID: 3848097054-4159625223
                                                        • Opcode ID: 0873a12c467b57eac1c96bf20eb27d9cceef51196e587e2d84295782b6f8941c
                                                        • Instruction ID: e1d5ef37c3c3d5af921fbad7ee9bebe5a21e11323d3cd3c0f25343d16cc12b49
                                                        • Opcode Fuzzy Hash: 0873a12c467b57eac1c96bf20eb27d9cceef51196e587e2d84295782b6f8941c
                                                        • Instruction Fuzzy Hash: 19F05C3774663863832012954D05BCF7A889F84BB0B110165FF00F7180E656AC80CAE5
                                                        Function 6CFE73FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: C:\Windows\Temp\{FC330374-63F0-43E3-9AA1-FF690503EA98}\.cr\8Rmoal0v85.exe
                                                        • API String ID: 0-3370540843
                                                        • Opcode ID: 97f8a856dc6bf9c692e18f74d1387c37b8d423125b099197408e68da35f94e38
                                                        • Instruction ID: deb2be578fbcd316cc08bfec5c1cd187d43fa468330db1a5a5d1ad7f652ef9e4
                                                        • Opcode Fuzzy Hash: 97f8a856dc6bf9c692e18f74d1387c37b8d423125b099197408e68da35f94e38
                                                        • Instruction Fuzzy Hash: D0418D71A05658FBDB15DF9DC880EDEBBB8EB8D314B1001ABE504D7741E7B09A45CBA0
                                                        Function 008F5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,008F1104,?,?,00000000), ref: 008F5142
                                                        • CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,008F1104,?,?,00000000), ref: 008F5172
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CompareStringlstrlen
                                                        • String ID: burn.clean.room
                                                        • API String ID: 1433953587-3055529264
                                                        • Opcode ID: e55aee045291b4c44ad5752aa67d7210b376336ad2b4607f231dae7dc5b09df8
                                                        • Instruction ID: be31b5153e91c0f5e33c312ce9109a1ce30bfb81f585f0eb33c20fc1fa62342c
                                                        • Opcode Fuzzy Hash: e55aee045291b4c44ad5752aa67d7210b376336ad2b4607f231dae7dc5b09df8
                                                        • Instruction Fuzzy Hash: 3B0162725187286F97304BA99D84A73B7ADF719762B204216F709C3620D370AC91EBA5
                                                        Function 008F3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 008F3877
                                                        • GetLastError.KERNEL32 ref: 008F3881
                                                        • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 008F38EA
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: DirectoryErrorLastLibraryLoadSystem
                                                        • String ID:
                                                        • API String ID: 1230559179-0
                                                        • Opcode ID: b69d91027c9fc9db7373a2438d019790c3f0499fec65396aafbf129a53593eb3
                                                        • Instruction ID: 5c00f9c3b5fc32fc8172254b4582c8cf06417f374173525216850ff84cfdd6d9
                                                        • Opcode Fuzzy Hash: b69d91027c9fc9db7373a2438d019790c3f0499fec65396aafbf129a53593eb3
                                                        • Instruction Fuzzy Hash: B721B3B2E0132DA7DB209B758C45FAA7BA8FB45750F1101A5BF14E7241DAB4DE448BE0
                                                        Function 008F3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,008F3BB6,00000000,?,008F1474,00000000,7694B390,00000000,7694B390,00000000,?,?,008F13B8), ref: 008F3A20
                                                        • RtlFreeHeap.NTDLL(00000000,?,008F3BB6,00000000,?,008F1474,00000000,7694B390,00000000,7694B390,00000000,?,?,008F13B8,?,00000100), ref: 008F3A27
                                                        • GetLastError.KERNEL32(?,008F3BB6,00000000,?,008F1474,00000000,7694B390,00000000,7694B390,00000000,?,?,008F13B8,?,00000100,?), ref: 008F3A31
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$ErrorFreeLastProcess
                                                        • String ID:
                                                        • API String ID: 406640338-0
                                                        • Opcode ID: b57c59f80336fa54c035af1d79b2cd697b55087fd672526b7fef5d4fb9c8e76f
                                                        • Instruction ID: 69fe64141bc0c25715931be876c6d5980e35c58a67ce7cd4aff3bf24821b4223
                                                        • Opcode Fuzzy Hash: b57c59f80336fa54c035af1d79b2cd697b55087fd672526b7fef5d4fb9c8e76f
                                                        • Instruction Fuzzy Hash: 98D01273A1C53D57872117E69C5CA6B7E58EF04AA17010121FF44D6220D725CD10AAE4
                                                        Function 008FF755 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                          • Part of subcall function 00930F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0095AAA0,00000000,?,009357E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00930F80
                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00907D59,?,?,?), ref: 008FF7B9
                                                          • Part of subcall function 00931026: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,?,00000000,?,?,?,008FF78E,00000000,Installed,00000000,?), ref: 0093104B
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: CloseOpenQueryValue
                                                        • String ID: Installed
                                                        • API String ID: 3677997916-3662710971
                                                        • Opcode ID: d3a504e8b9d0d9bf1dccfc5640e04dfeec4ac5f7d463cde3aeffa8bef82aaa98
                                                        • Instruction ID: 40c9618b4da79660bdabdf531a1fd4b3a43d60171de9e5874dfbec18dbfd056d
                                                        • Opcode Fuzzy Hash: d3a504e8b9d0d9bf1dccfc5640e04dfeec4ac5f7d463cde3aeffa8bef82aaa98
                                                        • Instruction Fuzzy Hash: 67014F3692021CEBCB15EBA4C946BEEBBB8EF04711F1141A5EA00A7161D7759E509B90
                                                        Function 00930F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0095AAA0,00000000,?,009357E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00930F80
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Open
                                                        • String ID: regutil.cpp
                                                        • API String ID: 71445658-955085611
                                                        • Opcode ID: cb1c14c0c48743d092be8e432ffe324ada9961da714fe6f3285e0537eaf51887
                                                        • Instruction ID: b24bca9a5e0538ea0503e0cdd3402d3076ff50ecad1806b0c21f296e491d9d36
                                                        • Opcode Fuzzy Hash: cb1c14c0c48743d092be8e432ffe324ada9961da714fe6f3285e0537eaf51887
                                                        • Instruction Fuzzy Hash: 83F02B37601236779B3045568C25B7FBE9EEFC47B0F154525BD46AF250E6258C009EF1
                                                        Function 0092F49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0092F491
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: d4673591763e262ae2aa817f414aaed1d8002c3c9f136730b0cdc873922a30fb
                                                        • Instruction ID: 6f0f8cbbf937135612ce3044adf48c7242f6fbf1f31bdde1f332420b7f5022b2
                                                        • Opcode Fuzzy Hash: d4673591763e262ae2aa817f414aaed1d8002c3c9f136730b0cdc873922a30fb
                                                        • Instruction Fuzzy Hash: 5AB092A12695116D2244A1162D2AA3B1198C2C5BA2720466EB800C1060E8840C090232
                                                        Function 0092F4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0092F491
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: 9ca55df5ccfebb9f0b475a4712b911f6e477e94dd3154eff7bc7b18f77a4af17
                                                        • Instruction ID: b931961b3f9261b67adfe439cdda56c396a45c3133b2af703e420676d7bd0e84
                                                        • Opcode Fuzzy Hash: 9ca55df5ccfebb9f0b475a4712b911f6e477e94dd3154eff7bc7b18f77a4af17
                                                        • Instruction Fuzzy Hash: ABB012A126D6116C3244E1162C3AF3B159CC2C5FB3730877EF800C1060ECC00C480332
                                                        Function 0092F479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0092F491
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID: PAyn
                                                        • API String ID: 1269201914-3488004521
                                                        • Opcode ID: a05bea65aaa7b6e8cc18a8ffb64a780d5b828407481c6fd113bf92c9f7c9447a
                                                        • Instruction ID: 96dbf08b594a3422dd0d7a031d9c7eccabe541a925458fd20b95f0151ecf7942
                                                        • Opcode Fuzzy Hash: a05bea65aaa7b6e8cc18a8ffb64a780d5b828407481c6fd113bf92c9f7c9447a
                                                        • Instruction Fuzzy Hash: D7B012A526D6117C3204A1122C3AE3B115CC2C1FB3730C77EFC00D0060ACC00C0802B2
                                                        Function 008F3AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(?,?,?,?,008F226D,?,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000), ref: 008F3B04
                                                        • RtlReAllocateHeap.NTDLL(00000000,?,008F226D,?,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000,00000000,8000FFFF), ref: 008F3B0B
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID:
                                                        • API String ID: 1357844191-0
                                                        • Opcode ID: 065ca1a44cda5e5f39afb2d896fe8e3ffffaf040042d8192e3ea682da4900165
                                                        • Instruction ID: 42b8f4d8124dd505e5ec7d9920026507cf65243b2f333454cfb2373915747cf8
                                                        • Opcode Fuzzy Hash: 065ca1a44cda5e5f39afb2d896fe8e3ffffaf040042d8192e3ea682da4900165
                                                        • Instruction Fuzzy Hash: 75D0C93216820DAB8F005FE8DC0DDAA3BACEB586027048405BA15C2120C739E420AA60
                                                        Function 008F394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • GetProcessHeap.KERNEL32(?,?,?,008F2274,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000,00000000,8000FFFF), ref: 008F3960
                                                        • RtlAllocateHeap.NTDLL(00000000,?,008F2274,?,00000001,7694B390,8000FFFF,?,?,00930267,?,?,00000000,00000000,8000FFFF), ref: 008F3967
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: Heap$AllocateProcess
                                                        • String ID:
                                                        • API String ID: 1357844191-0
                                                        • Opcode ID: 9e6bba51d93067b7dcb7c8057b82b0df262ff001b9afc51c15d6079df436ed8f
                                                        • Instruction ID: b78ba04e9d712f0284c6deb26b71e41ef89bb687325d6f921c5aed6b2cab4d5b
                                                        • Opcode Fuzzy Hash: 9e6bba51d93067b7dcb7c8057b82b0df262ff001b9afc51c15d6079df436ed8f
                                                        • Instruction Fuzzy Hash: 55C012321AC20CAB8B006FF8EC0EC9A3BACBB286027048401BA05C2120C738E010AB60
                                                        Function 009335C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • VariantInit.OLEAUT32(?), ref: 009335F8
                                                          • Part of subcall function 0093304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00933609,00000000,?,00000000), ref: 00933069
                                                          • Part of subcall function 0093304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0091C025,?,008F5405,?,00000000,?), ref: 00933075
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ErrorHandleInitLastModuleVariant
                                                        • String ID:
                                                        • API String ID: 52713655-0
                                                        • Opcode ID: bec903122ccc3448f285ad9dbac0feaa6d90044573598b781bffa8450593c51b
                                                        • Instruction ID: e62a64dd045f382a263729f57046d99b1e62a2c5ca7b4a35fa45ad5822f00b1e
                                                        • Opcode Fuzzy Hash: bec903122ccc3448f285ad9dbac0feaa6d90044573598b781bffa8450593c51b
                                                        • Instruction Fuzzy Hash: 70313E76E01229AFCB11DFA9C885ADEB7F8EF08710F01856AED15BB311D6759D008FA4
                                                        Function 0092521A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • RtlAllocateHeap.NTDLL(00000000,?,?,?,00921F87,?,0000015D,?,?,?,?,009233E0,000000FF,00000000,?,?), ref: 0092524C
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AllocateHeap
                                                        • String ID:
                                                        • API String ID: 1279760036-0
                                                        • Opcode ID: 5f8cfa560329cd3c79cf40187ff28efb1efcc74e8c24d941027ec94aa62d4772
                                                        • Instruction ID: ef65ba8630c5cadbd1ba7e7474d036c52157da69595213dfc3f6410688cd1911
                                                        • Opcode Fuzzy Hash: 5f8cfa560329cd3c79cf40187ff28efb1efcc74e8c24d941027ec94aa62d4772
                                                        • Instruction Fuzzy Hash: 2FE0ED31604A70EAEA212665BC09B5A374C9FA23B1F270220AD30A20DCCBB0CC0082A1
                                                        Function 008F34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00908BD3,0000001C,80070490,00000000,00000000,80070490), ref: 008F34D5
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: FolderPath
                                                        • String ID:
                                                        • API String ID: 1514166925-0
                                                        • Opcode ID: 3e8d6ec3b31970b674d6d993c5637b011066ce29951b733eeeeb98ba96ebc418
                                                        • Instruction ID: 5f895cfca35f309714df32a37d49c4ebdaa2a75348b0ab74e31235c8acbb1c83
                                                        • Opcode Fuzzy Hash: 3e8d6ec3b31970b674d6d993c5637b011066ce29951b733eeeeb98ba96ebc418
                                                        • Instruction Fuzzy Hash: 51E0127220112D7BEA026F755C09DFB7B5CFF253647008051BF40D6010D762D59096B5
                                                        Function 00939684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0093966B
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: 659c6ae405a414821fd249332fcb5c86fbb7e5219a772f07a86b71501aecbed0
                                                        • Instruction ID: f78ea8a7e04e1992efd8a69621b2afc69df1f6d434b50161ab7618d6b4a998bc
                                                        • Opcode Fuzzy Hash: 659c6ae405a414821fd249332fcb5c86fbb7e5219a772f07a86b71501aecbed0
                                                        • Instruction Fuzzy Hash: 96B012D126E3016C3A44D2463E43F37058CC7C0B57B30461EB801E6040E8C40C0A0732
                                                        Function 00939653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0093966B
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: 6f0a8ef4c4b40eac7fb13380a0b6b00c9fa62fd527c7fd23bc1c5dcbff71ae08
                                                        • Instruction ID: 2e983467595dc44878512e64b007a1ae7420127438cd6eb5aa5edaeab3778b5a
                                                        • Opcode Fuzzy Hash: 6f0a8ef4c4b40eac7fb13380a0b6b00c9fa62fd527c7fd23bc1c5dcbff71ae08
                                                        • Instruction Fuzzy Hash: 64B0129126E2017C3A0492027C83F37054CC7C0B57B30861EB800F5040E8C00C090737
                                                        Function 00939674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0093966B
                                                          • Part of subcall function 0093998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00939A09
                                                          • Part of subcall function 0093998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00939A1A
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2458952983.00000000008F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 008F0000, based on PE: true
                                                        • Associated: 00000002.00000002.2458919133.00000000008F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459105854.000000000093B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459153058.000000000095A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.2459168979.000000000095D000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_8f0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                        • String ID:
                                                        • API String ID: 1269201914-0
                                                        • Opcode ID: 3cd016b65ab657322f5e8c409cd60c53cdd52b1b3bf88da0880acf769bcf7ed4
                                                        • Instruction ID: 6a04dbbd895eed2a398eacb34e3cce2181ced94af3041124999091d10286a4b5
                                                        • Opcode Fuzzy Hash: 3cd016b65ab657322f5e8c409cd60c53cdd52b1b3bf88da0880acf769bcf7ed4
                                                        • Instruction Fuzzy Hash: 76B0129126F1026C3644D2061C03F37058CC7C4B17B30C61EBC00D5040E8C00C0D0732

                                                        Non-executed Functions

                                                        Function 6CFDDCB0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 437filestringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,7AFFAC98,?,00000000,?), ref: 6CFDDD09
                                                        • lstrcmpW.KERNEL32(?), ref: 6CFDDD18
                                                        • lstrlenW.KERNEL32(?), ref: 6CFDDD33
                                                        • FindFirstFileW.KERNEL32(?,00000000,6D004D0C,00000002), ref: 6CFDDDF6
                                                        • lstrlenW.KERNEL32(?), ref: 6CFDDE0E
                                                        • DeleteFileW.KERNEL32(?,?,?,6D003E14,00000001), ref: 6CFDDF2B
                                                        • FindNextFileW.KERNEL32(?,00000000), ref: 6CFDDF54
                                                        • DeleteFileW.KERNEL32(?,?,?,?,00000001), ref: 6CFDE0C6
                                                        • FindNextFileW.KERNEL32(?,00000000), ref: 6CFDE0EF
                                                        • FindClose.KERNEL32(?), ref: 6CFDE125
                                                        • RemoveDirectoryW.KERNEL32(?), ref: 6CFDE133
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: File$Find$DeleteDirectoryNextlstrlen$CloseFirstRemoveWindowslstrcmp
                                                        • String ID: temp
                                                        • API String ID: 4087283718-190023114
                                                        • Opcode ID: fe7d881e11cede04b2b20dd597420023316937a64d044683e26ce3f07937e0ac
                                                        • Instruction ID: e6c09728418b522ff259af5fb3bdaea8267954da3ad491e2fe720aa06f98b021
                                                        • Opcode Fuzzy Hash: fe7d881e11cede04b2b20dd597420023316937a64d044683e26ce3f07937e0ac
                                                        • Instruction Fuzzy Hash: 4FF1D631A00149DFEB00DFA8CC84BEEB7B5FF15318F1A8259D825AB691D735A904CFA0
                                                        Function 6CFE2DC4 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE
                                                        Download Yara Rule
                                                        APIs
                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 6CFE2EBF
                                                        • type_info::operator==.LIBVCRUNTIME ref: 6CFE2EE6
                                                        • ___TypeMatch.LIBVCRUNTIME ref: 6CFE2FF2
                                                        • IsInExceptionSpec.LIBVCRUNTIME ref: 6CFE30CD
                                                        • _UnwindNestedFrames.LIBCMT ref: 6CFE3154
                                                        • CallUnexpected.LIBVCRUNTIME ref: 6CFE316F
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                        • String ID: csm$csm$csm
                                                        • API String ID: 2123188842-393685449
                                                        • Opcode ID: 4fa7d945096bc0e830a47b3a4d71f8cb46a7ed01fdfee7be60966aa5cd82cad8
                                                        • Instruction ID: 8979ea4a61294bda2b3c81f5c6444e6e5802391a1c773225cb881b1fb5314979
                                                        • Opcode Fuzzy Hash: 4fa7d945096bc0e830a47b3a4d71f8cb46a7ed01fdfee7be60966aa5cd82cad8
                                                        • Instruction Fuzzy Hash: 79C1AF71D01219BFCF15CFA4C888ADEBB75BF0C318F15415AE8106BA21E736DA59CB91
                                                        Function 6CFE7CE4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        • _free.LIBCMT ref: 6CFE7CED
                                                          • Part of subcall function 6CFE8D85: HeapFree.KERNEL32(00000000,00000000,?,6CFEEF55,00000000,00000000,00000000,?,?,6CFEEF7C,00000000,00000007,00000000,?,6CFEEC3E,00000000), ref: 6CFE8D9B
                                                          • Part of subcall function 6CFE8D85: GetLastError.KERNEL32(00000000,?,6CFEEF55,00000000,00000000,00000000,?,?,6CFEEF7C,00000000,00000007,00000000,?,6CFEEC3E,00000000,00000000), ref: 6CFE8DAD
                                                        • _free.LIBCMT ref: 6CFE7D00
                                                        • _free.LIBCMT ref: 6CFE7D11
                                                        • _free.LIBCMT ref: 6CFE7D22
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: _free$ErrorFreeHeapLast
                                                        • String ID:
                                                        • API String ID: 776569668-0
                                                        • Opcode ID: ea7ee99a5f204b70c76c3d6eaa2c5c8b76025c36c8987aa3a639044ad3a583f0
                                                        • Instruction ID: 96beb7f424f540c1c75979694be5e5a9b03287bffe6424937347f1566b633be7
                                                        • Opcode Fuzzy Hash: ea7ee99a5f204b70c76c3d6eaa2c5c8b76025c36c8987aa3a639044ad3a583f0
                                                        • Instruction Fuzzy Hash: 40E0B679801660BA8E266F5C9808B893B71B79EB26745010EE40452718E77105579FED
                                                        Function 6CFDEC60 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 232COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID: HeapProcess
                                                        • String ID: BIN\STSADM.EXE$Location
                                                        • API String ID: 54951025-3562773343
                                                        • Opcode ID: 765520f61d2b4b3893cfa84a7360419d41a173ce3d984319ab415c1edbf54026
                                                        • Instruction ID: af5604da12288fb09c0ecb180a3c5702f26d1385658349786954e81ea584af7b
                                                        • Opcode Fuzzy Hash: 765520f61d2b4b3893cfa84a7360419d41a173ce3d984319ab415c1edbf54026
                                                        • Instruction Fuzzy Hash: D6819F31A0020ADFEB10CFA8C844BAEF7B8FF05318F19456AE951A7791DB75A904CBD1
                                                        Function 6CFD2C30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.2460325445.000000006CFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CFD0000, based on PE: true
                                                        • Associated: 00000002.00000002.2460241396.000000006CFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460353984.000000006CFFA000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460374258.000000006D00B000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                        • Associated: 00000002.00000002.2460390304.000000006D00D000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_6cfd0000_8Rmoal0v85.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: \\?\$\\?\UNC\
                                                        • API String ID: 0-3019864461
                                                        • Opcode ID: 09901cdb528cc5b0d7e273369b6b82e1f1ae151028853fe28aad631f01ff65d5
                                                        • Instruction ID: d04304aa9ae738d524da8898c012e16a189db4c44653235a831661f2fe4b2f93
                                                        • Opcode Fuzzy Hash: 09901cdb528cc5b0d7e273369b6b82e1f1ae151028853fe28aad631f01ff65d5
                                                        • Instruction Fuzzy Hash: 1751B371A002049BDB14CFA4D944BEEB7B5FF49358F19851DD411A7A80DB76BD88CBD0