Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
1wrLmYiC62.exe

Overview

General Information

Sample name:1wrLmYiC62.exe
renamed because original name is a hash value
Original sample name:dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5.exe
Analysis ID:1586714
MD5:9c540950f5a8981844ff33bfc55d2f36
SHA1:8c70f2bcb995ce313843cf7103c659c12eb263dc
SHA256:dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5
Tags:exeuser-crep1x
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

  • System is w10x64
  • 1wrLmYiC62.exe (PID: 7940 cmdline: "C:\Users\user\Desktop\1wrLmYiC62.exe" MD5: 9C540950F5A8981844FF33BFC55D2F36)
    • 1wrLmYiC62.exe (PID: 7960 cmdline: "C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720 MD5: 9C540950F5A8981844FF33BFC55D2F36)
      • AdobeSync.exe (PID: 7992 cmdline: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
        • AdobeSync.exe (PID: 8028 cmdline: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)
          • cmd.exe (PID: 8044 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • LocalCtrl_alpha_v3.exe (PID: 1560 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • AdobeSync.exe (PID: 1844 cmdline: "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe" MD5: F778E9136AB0DB9DE9802A7043DE50A7)
    • cmd.exe (PID: 2092 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • LocalCtrl_alpha_v3.exe (PID: 3960 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\rgwqvdwReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\utxcagyaReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeReversingLabs: Detection: 44%
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AXE8SharedExpat.dllReversingLabs: Detection: 30%
Multi AV Scanner detection for submitted file
Source: 1wrLmYiC62.exeReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\utxcagyaJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\rgwqvdwJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0046A0BB DecryptFileW,1_2_0046A0BB
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,1_2_0048FA62
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00469E9E DecryptFileW,DecryptFileW,1_2_00469E9E
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C7A0BB DecryptFileW,2_2_00C7A0BB
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,2_2_00C9FA62
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C79E9E DecryptFileW,DecryptFileW,2_2_00C79E9E
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DF00D0 CryptProtectData,_CxxThrowException,3_2_00DF00D0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DF0070 CryptUnprotectData,_CxxThrowException,3_2_00DF0070
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B400D0 CryptProtectData,_CxxThrowException,4_2_00B400D0
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B40070 CryptUnprotectData,_CxxThrowException,4_2_00B40070
Source: 1wrLmYiC62.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dllJump to behavior
Source: 1wrLmYiC62.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 1wrLmYiC62.exe, 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000001.00000000.1479351379.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.1482492391.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 1wrLmYiC62.exe, 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996047611.0000000006814000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996678767.0000000006E15000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995589393.0000000006412000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990940786.000000000441E000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995816425.0000000006615000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990749390.0000000004214000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990407629.0000000004016000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993241445.0000000005813000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991655538.0000000004A1D000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1989964728.0000000003C12000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992197688.000000000501A000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1997119674.0000000007218000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995376296.0000000006213000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1988836240.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996276798.0000000006A1B000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991859322.0000000004C14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992028697.0000000004E16000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990168837.0000000003E19000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995084777.0000000006017000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992935437.0000000005617000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993940098.0000000005A1C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992640463.000000000541C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996460471.0000000006C13000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1994837795.0000000005E14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996877315.0000000007013000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987538325.00000000021D4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991154037.0000000004618000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.1511406038.000000000A1E0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511135580.0000000009E82000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572019852.0000000009D83000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1573120054.000000000A49B000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572656920.000000000A0E0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871075111.0000000005061000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871547552.0000000005930000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940012643.00000000095DB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940122747.0000000009930000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940262573.0000000009CE0000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146170740.000000000520E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146624888.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996047611.0000000006814000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996678767.0000000006E15000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995589393.0000000006412000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990940786.000000000441E000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995816425.0000000006615000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990749390.0000000004214000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990407629.0000000004016000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993241445.0000000005813000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991655538.0000000004A1D000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1989964728.0000000003C12000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992197688.000000000501A000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1997119674.0000000007218000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995376296.0000000006213000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1988836240.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996276798.0000000006A1B000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991859322.0000000004C14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992028697.0000000004E16000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990168837.0000000003E19000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995084777.0000000006017000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992935437.0000000005617000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993940098.0000000005A1C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992640463.000000000541C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996460471.0000000006C13000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1994837795.0000000005E14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996877315.0000000007013000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987538325.00000000021D4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991154037.00000000046180
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.1511406038.000000000A1E0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511135580.0000000009E82000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572019852.0000000009D83000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1573120054.000000000A49B000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572656920.000000000A0E0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871075111.0000000005061000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871547552.0000000005930000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940012643.00000000095DB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940122747.0000000009930000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940262573.0000000009CE0000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146170740.000000000520E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146624888.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 1wrLmYiC62.exe, 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000002.1512068554.000000006E811000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.1574862353.000000006ECB1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.1940838085.0000000070031000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000002.1505410812.0000000000E2D000.00000002.00000001.01000000.00000007.sdmp, AdobeSync.exe, 00000003.00000000.1487253926.0000000000E2D000.00000002.00000001.01000000.00000007.sdmp, AdobeSync.exe, 00000004.00000002.1566644682.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 00000004.00000000.1504763107.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 0000000B.00000002.1936538338.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 0000000B.00000000.1870472158.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.1512357530.000000006E840000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.1575100837.000000006ECE0000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.1940915256.0000000070060000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000002.1512068554.000000006E811000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.1574862353.000000006ECB1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.1940838085.0000000070031000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.1512357530.000000006E840000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.1575100837.000000006ECE0000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.1940915256.0000000070060000.00000002.00000001.01000000.0000000D.sdmp
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00453CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_00453CC4
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00494440 FindFirstFileW,FindClose,1_2_00494440
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00469B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,1_2_00469B43
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00487B87 FindFirstFileExW,1_2_00487B87
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00CA4440 FindFirstFileW,FindClose,2_2_00CA4440
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C97B87 FindFirstFileExW,2_2_00C97B87
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C79B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_00C79B43
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C63CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_00C63CC4
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E85DCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6E85DCB0
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86DB36 FindFirstFileExW,2_2_6E86DB36
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DACE10 FindFirstFileW,3_2_00DACE10
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DABB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,3_2_00DABB70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00AFCE10 FindFirstFileW,4_2_00AFCE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00AFBB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_00AFBB70
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: unknownDNS traffic detected: query: tataragirld.site replaycode: Name error (3)
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DA4970 HttpSendRequestA,printf,_CxxThrowException,HttpSendRequestA,InternetReadFile,_CxxThrowException,HttpEndRequestA,3_2_00DA4970
Source: global trafficDNS traffic detected: DNS query: tataragirld.site
Source: 1wrLmYiC62.exeString found in binary or memory: http://appsyndication.org/2006/appsyn
Source: 1wrLmYiC62.exe, 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000001.00000000.1479351379.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.1482492391.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
Source: 1wrLmYiC62.exe, 00000001.00000002.1502604585.000000000127E000.00000004.00000020.00020000.00000000.sdmp, 1wrLmYiC62.exe, 00000001.00000003.1502110806.000000000127B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsoft.cA
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.???.xx/?search=%s
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AdobeSync.exe, 00000003.00000002.1509912216.0000000008164000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.0000000008066000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.00000000053C5000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.00000000025D6000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.00000000078AD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.000000000556E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.com
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.de
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.2271686107.0000000140156000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.surfok.de/
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2250932519.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2239619941.0000000000482000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2241242942.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/)k
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/.%
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2241242942.0000000000460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_Englan
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?om
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1973034940.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1971474122.0000000000578000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2255430262.0000000000460000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2BgLgGV
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/5k
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1981613429.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983342658.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/9k.
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1977287618.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/=k
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/C%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1974423173.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/Ej
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/F%
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/J%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1971474122.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/Qj
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2250932519.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/R%
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/V%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/Yj
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1977287618.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/aj
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/f%
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/n%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/qj
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/r%
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/v%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/w%
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1974423173.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1973034940.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site/yj
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1986258096.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983503387.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1981949287.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983196049.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443
Source: LocalCtrl_alpha_v3.exe, 00000010.00000003.2239619941.0000000000482000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2241242942.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2Bg
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1971065667.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1971474122.0000000000541000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443NC
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1986258096.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983503387.0000000000588000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443Q
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000003.1973034940.0000000000541000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tataragirld.site:443W
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: C:\Users\user\Desktop\1wrLmYiC62.exeFile deleted: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048001D1_2_0048001D
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004741EA1_2_004741EA
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004562AA1_2_004562AA
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047C3321_2_0047C332
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004803D51_2_004803D5
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048A5601_2_0048A560
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004807AA1_2_004807AA
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0045A8F11_2_0045A8F1
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048AA0E1_2_0048AA0E
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00480B6F1_2_00480B6F
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047FB891_2_0047FB89
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00482C181_2_00482C18
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00482E471_2_00482E47
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048EE7C1_2_0048EE7C
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9001D2_2_00C9001D
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C841EA2_2_00C841EA
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C662AA2_2_00C662AA
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C903D52_2_00C903D5
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8C3322_2_00C8C332
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9A5602_2_00C9A560
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C907AA2_2_00C907AA
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C6A8F12_2_00C6A8F1
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9AA0E2_2_00C9AA0E
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8FB892_2_00C8FB89
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C90B6F2_2_00C90B6F
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C92C182_2_00C92C18
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C92E472_2_00C92E47
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9EE7C2_2_00C9EE7C
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E854EA02_2_6E854EA0
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86BF892_2_6E86BF89
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E872F422_2_6E872F42
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8664E02_2_6E8664E0
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8535702_2_6E853570
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8652552_2_6E865255
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86F3DF2_2_6E86F3DF
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86B3DB2_2_6E86B3DB
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8730622_2_6E873062
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8621B02_2_6E8621B0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DC76103_2_00DC7610
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B176104_2_00B17610
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 00CA0237 appears 695 times
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 00CA0726 appears 34 times
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 6E860F70 appears 47 times
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 00C63821 appears 502 times
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 00C61F13 appears 53 times
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: String function: 00CA32F3 appears 83 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: String function: 004932F3 appears 85 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: String function: 00451F13 appears 53 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: String function: 00453821 appears 500 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: String function: 00490237 appears 691 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: String function: 00490726 appears 34 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00AA6970 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00AA5A10 appears 67 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00B45F10 appears 43 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00AC4080 appears 32 times
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: String function: 00AF8490 appears 423 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00DA8490 appears 642 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00D51013 appears 38 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00D56970 appears 43 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00E18A9E appears 32 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00DF5F10 appears 43 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00D55A10 appears 92 times
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: String function: 00D74080 appears 43 times
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
Source: utxcagya.5.drStatic PE information: Number of sections : 12 > 10
Source: rgwqvdw.12.drStatic PE information: Number of sections : 12 > 10
Source: 1wrLmYiC62.exe, 00000001.00000000.1479437411.00000000004BD000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000000.1482544712.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamegallon.exe4 vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenameSharePoint.dllF vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite.dllX vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
Source: classification engineClassification label: mal84.evad.winEXE@18/26@2/0
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048FE21 FormatMessageW,GetLastError,LocalFree,1_2_0048FE21
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004545EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,1_2_004545EE
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C645EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,2_2_00C645EE
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0049304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,1_2_0049304F
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E857F40 LoadResource,LockResource,SizeofResource,2_2_6E857F40
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00476B88 ChangeServiceConfigW,GetLastError,1_2_00476B88
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCFJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
Source: C:\Users\user\Desktop\1wrLmYiC62.exeFile created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: cabinet.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: msi.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: version.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: wininet.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: comres.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: clbcatq.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: msasn1.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: crypt32.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: feclient.dll1_2_00451070
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCommand line argument: cabinet.dll1_2_00451070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: cabinet.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: msi.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: version.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: wininet.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: comres.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: clbcatq.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: msasn1.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: crypt32.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: feclient.dll2_2_00C61070
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCommand line argument: cabinet.dll2_2_00C61070
Source: 1wrLmYiC62.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: 1wrLmYiC62.exe, 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: SELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmp;.\\?\\\?\UNC\\\invalid string position\ *AI_WSP_LISTAI_WSP_FEATURES_LIST[AI_WSP_URL]AI_SHAREPOINT_LOGAI_GLOBAL_WSPAI_LOCAL_WSPAI_NOT_VITAL_WSPAI_DEPLOY_WSP_CADATAAI_DEPLOY_WSP_CADATA_64AI_SHAREPOINT_STRINGS,|$^.cab.wspSharePoint.log-url [AI_WSP_URL] -allcontenturls-immediate-time-local-allowgacdeployment-allowcaspolicies-force-idSPAdminSPAdminV4SPTimerV3SPTimerV4
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM ' || quote(name) || ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 1wrLmYiC62.exe, 00000002.00000003.1486446568.00000000010D6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511901266.000000006D1E3000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000003.00000002.1505519705.0000000001016000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1574549072.000000006E893000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.1940766069.0000000070013000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: 1wrLmYiC62.exeReversingLabs: Detection: 44%
Source: 1wrLmYiC62.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: 1wrLmYiC62.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\1wrLmYiC62.exeFile read: C:\Users\user\Desktop\1wrLmYiC62.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\1wrLmYiC62.exe "C:\Users\user\Desktop\1wrLmYiC62.exe"
Source: C:\Users\user\Desktop\1wrLmYiC62.exeProcess created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeProcess created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: unknownProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: C:\Users\user\Desktop\1wrLmYiC62.exeProcess created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720 Jump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeProcess created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeProcess created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: axe8sharedexpat.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: bib.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: sqlite.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pla.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: tdh.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: wevtapi.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: shdocvw.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32Jump to behavior
Source: payyyvinnqb.5.drLNK file: ..\..\Roaming\PatchReaderWCF\AdobeSync.exe
Source: 1wrLmYiC62.exeStatic file information: File size 6305325 > 1048576
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile opened: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dllJump to behavior
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: 1wrLmYiC62.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: 1wrLmYiC62.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 1wrLmYiC62.exe, 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000001.00000000.1479351379.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.1482492391.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 1wrLmYiC62.exe, 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996047611.0000000006814000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996678767.0000000006E15000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995589393.0000000006412000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990940786.000000000441E000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995816425.0000000006615000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990749390.0000000004214000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990407629.0000000004016000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993241445.0000000005813000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991655538.0000000004A1D000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1989964728.0000000003C12000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992197688.000000000501A000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1997119674.0000000007218000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995376296.0000000006213000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1988836240.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996276798.0000000006A1B000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991859322.0000000004C14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992028697.0000000004E16000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990168837.0000000003E19000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995084777.0000000006017000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992935437.0000000005617000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993940098.0000000005A1C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992640463.000000000541C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996460471.0000000006C13000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1994837795.0000000005E14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996877315.0000000007013000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987538325.00000000021D4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991154037.0000000004618000.
Source: Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.1511406038.000000000A1E0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511135580.0000000009E82000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572019852.0000000009D83000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1573120054.000000000A49B000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572656920.000000000A0E0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871075111.0000000005061000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871547552.0000000005930000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940012643.00000000095DB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940122747.0000000009930000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940262573.0000000009CE0000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146170740.000000000520E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146624888.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996047611.0000000006814000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996678767.0000000006E15000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995589393.0000000006412000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990940786.000000000441E000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995816425.0000000006615000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990749390.0000000004214000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990407629.0000000004016000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993241445.0000000005813000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991655538.0000000004A1D000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1989964728.0000000003C12000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992197688.000000000501A000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1997119674.0000000007218000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995376296.0000000006213000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1988836240.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996276798.0000000006A1B000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991859322.0000000004C14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992028697.0000000004E16000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1990168837.0000000003E19000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1995084777.0000000006017000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992935437.0000000005617000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1993940098.0000000005A1C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1992640463.000000000541C000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996460471.0000000006C13000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1994837795.0000000005E14000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1996877315.0000000007013000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987538325.00000000021D4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1991154037.00000000046180
Source: Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.1511406038.000000000A1E0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.1511135580.0000000009E82000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572019852.0000000009D83000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1573120054.000000000A49B000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1572656920.000000000A0E0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871075111.0000000005061000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871547552.0000000005930000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940012643.00000000095DB000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940122747.0000000009930000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1940262573.0000000009CE0000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146170740.000000000520E000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146624888.0000000005AE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 1wrLmYiC62.exe, 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000002.1512068554.000000006E811000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.1574862353.000000006ECB1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.1940838085.0000000070031000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000002.1505410812.0000000000E2D000.00000002.00000001.01000000.00000007.sdmp, AdobeSync.exe, 00000003.00000000.1487253926.0000000000E2D000.00000002.00000001.01000000.00000007.sdmp, AdobeSync.exe, 00000004.00000002.1566644682.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 00000004.00000000.1504763107.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 0000000B.00000002.1936538338.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp, AdobeSync.exe, 0000000B.00000000.1870472158.0000000000B7D000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.1512357530.000000006E840000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.1575100837.000000006ECE0000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.1940915256.0000000070060000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000002.1512068554.000000006E811000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000004.00000002.1574862353.000000006ECB1000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.1940838085.0000000070031000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.1512357530.000000006E840000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000002.1575100837.000000006ECE0000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.1940915256.0000000070060000.00000002.00000001.01000000.0000000D.sdmp
Source: 1wrLmYiC62.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1wrLmYiC62.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1wrLmYiC62.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1wrLmYiC62.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1wrLmYiC62.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: 1wrLmYiC62.exeStatic PE information: real checksum: 0x0 should be: 0x60e0b6
Source: Quadruple.dll.2.drStatic PE information: real checksum: 0x4dc7e should be: 0x4a7b1
Source: utxcagya.5.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: 1wrLmYiC62.exe.1.drStatic PE information: real checksum: 0x0 should be: 0x60e0b6
Source: AXE8SharedExpat.dll.3.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: AXE8SharedExpat.dll.2.drStatic PE information: real checksum: 0x32631 should be: 0x361f1
Source: rgwqvdw.12.drStatic PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: 1wrLmYiC62.exeStatic PE information: section name: .wixburn
Source: 1wrLmYiC62.exe.1.drStatic PE information: section name: .wixburn
Source: LocalCtrl_alpha_v3.exe.5.drStatic PE information: section name: Shared
Source: utxcagya.5.drStatic PE information: section name: .xdata
Source: utxcagya.5.drStatic PE information: section name: ubpux
Source: rgwqvdw.12.drStatic PE information: section name: .xdata
Source: rgwqvdw.12.drStatic PE information: section name: ubpux
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047EAD6 push ecx; ret 1_2_0047EAE9
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8EAD6 push ecx; ret 2_2_00C8EAE9
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E860FB4 push ecx; ret 2_2_6E860FC6
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E18249 push ecx; ret 3_2_00E1825C
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E18B07 push ecx; ret 3_2_00E18B1A
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B68249 push ecx; ret 4_2_00B6825C
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B68B07 push ecx; ret 4_2_00B68B1A
Source: msvcr90.dll.2.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.3.drStatic PE information: section name: .text entropy: 6.9217598022130655
Source: C:\Users\user\Desktop\1wrLmYiC62.exeFile created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\rgwqvdwJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dllJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\utxcagyaJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeFile created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dllJump to dropped file
Source: C:\Users\user\Desktop\1wrLmYiC62.exeFile created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\BIB.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AXE8SharedExpat.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\sqlite.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeFile created: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\utxcagyaJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\rgwqvdwJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\UTXCAGYA
Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\RGWQVDW
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E85FBC5 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,2_2_6E85FBC5

Malware Analysis System Evasion

barindex
Switches to a custom stack to bypass stack traces
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CD67C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CD67C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CD67945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CD63B54
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CE47C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeAPI/Special instruction interceptor: Address: 6CE47945
Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CE43B54
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeDropped PE file which has not been started: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\Quadruple.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeDropped PE file which has not been started: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcp90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\rgwqvdwJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dllJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\utxcagyaJump to dropped file
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeDropped PE file which has not been started: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dllJump to dropped file
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeEvaded block: after key decision
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeEvaded block: after key decision
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeAPI coverage: 9.4 %
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe TID: 7964Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 4428Thread sleep time: -35996s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 4240Thread sleep time: -180000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 3952Thread sleep time: -35996s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 6948Thread sleep time: -60000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 5256Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0048FF61h1_2_0048FEC6
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0048FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0048FF5Ah1_2_0048FEC6
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00C9FF61h2_2_00C9FEC6
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C9FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00C9FF5Ah2_2_00C9FEC6
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00453CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_00453CC4
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00494440 FindFirstFileW,FindClose,1_2_00494440
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00469B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,1_2_00469B43
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00487B87 FindFirstFileExW,1_2_00487B87
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00CA4440 FindFirstFileW,FindClose,2_2_00CA4440
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C97B87 FindFirstFileExW,2_2_00C97B87
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C79B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_00C79B43
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C63CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_00C63CC4
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E85DCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,2_2_6E85DCB0
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86DB36 FindFirstFileExW,2_2_6E86DB36
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DACE10 FindFirstFileW,3_2_00DACE10
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00DABB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,3_2_00DABB70
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00AFCE10 FindFirstFileW,4_2_00AFCE10
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00AFBB70 FindFirstFileW,GetFullPathNameW,GetLastError,FindFirstFileW,GetLastError,FindClose,_CxxThrowException,4_2_00AFBB70
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004997A5 VirtualQuery,GetSystemInfo,1_2_004997A5
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeThread delayed: delay time: 30000Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Jump to behavior
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
Source: cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
Source: LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: LocalCtrl_alpha_v3.exe, 00000010.00000002.2255430262.0000000000424000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgg
Source: C:\Users\user\Desktop\1wrLmYiC62.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0047E88A
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00D51412 OutputDebugStringA,GetLastError,3_2_00D51412
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004848D8 mov eax, dword ptr fs:[00000030h]1_2_004848D8
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C948D8 mov eax, dword ptr fs:[00000030h]2_2_00C948D8
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E86D82F mov eax, dword ptr fs:[00000030h]2_2_6E86D82F
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8672E9 mov eax, dword ptr fs:[00000030h]2_2_6E8672E9
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0045394F GetProcessHeap,RtlAllocateHeap,1_2_0045394F
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_0047E3D8
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0047E88A
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047E9DC SetUnhandledExceptionFilter,1_2_0047E9DC
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00483C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00483C76
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00C8E3D8
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00C8E88A
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C8E9DC SetUnhandledExceptionFilter,2_2_00C8E9DC
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_00C93C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00C93C76
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E863EDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6E863EDE
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E860C6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6E860C6C
Source: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exeCode function: 2_2_6E8603FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_6E8603FB
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E1762E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,3_2_00E1762E
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeCode function: 4_2_00B6762E IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,4_2_00B6762E

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6E8D16342Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67BB279C3
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x6ECC2240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF67B9241F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF67B9B7F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF67B9D97BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x14011D93EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8D179E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF67B9B8D66Jump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeNtProtectVirtualMemory: Direct from: 0x77667B2EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BC6EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6E8BC9EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF67B9D9EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8B9A91E
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67B9AA91E
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF67BA30DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF67B9C02F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67BA09090Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF67B923FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF67B9BF9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF67BA06678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x7FF6E8BA8D66Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF8418A4B5EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF67B9DA7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6E8BCAAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6E8D154B3Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x14011D808Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6E8BB02F7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BA7F4BJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6E8BAF9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BF9090Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF67B9BF270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6E8BA1CB2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6E8C20DADJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF6E8D12F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6E8BCA7D4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF67B9D9DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF67B9B8C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67B9A4EF6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67B9BFBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6E8B141F8Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8D16770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtOpenKeyEx: Direct from: 0x7FF6E8BC97BDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF67BB2325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B92991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67BB254D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8D154D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6E8D1325DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF6E8D2299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B92FD88Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67BB26770Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateThreadEx: Direct from: 0x7FF6E8B13FB7Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6E8B9DD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B9B838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BAA90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadVirtualMemory: Direct from: 0x7FF67BB22F76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8B1991DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF67B9AD940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6E8B94E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BA8D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67B9A4E3AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67BB3299EJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF67B9BF369Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67B9ADD22Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67B9BD226Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B923E52Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF67BB254B3Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtQuerySystemInformation: Direct from: 0x776663E1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8B1FD88Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BA838AJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B9BA90DJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF6E8BC9DFEJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B92C9FFJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeNtSetInformationThread: Direct from: 0x70042240Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8B9D940Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF8418826A1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationProcess: Direct from: 0x7FF6E8BAF369Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF67B9B8D09Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8B13E52Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8B1C9FFJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67BB279E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x7FF6E8BA8C13Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8D179C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtMapViewOfSection: Direct from: 0x7FF6E8B94EF6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x7FF6E8BF6678Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67BB32A76Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtReadFile: Direct from: 0x14011D832Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryValueKey: Direct from: 0x7FF67B9DAAD6Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67BB26342Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationThread: Direct from: 0x7FF6E8D209E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtCreateFile: Direct from: 0x14011D7A4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF67BB279D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQuerySystemInformation: Direct from: 0x7FF67B9B1CB2Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtProtectVirtualMemory: Direct from: 0x7FF67BB309E4Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtQueryInformationToken: Direct from: 0x7FF67B9D6EEDJump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtSetInformationProcess: Direct from: 0x7FF6E8BAF270Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8D179D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtClose: Direct from: 0x7FF6E8BAFBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeNtAllocateVirtualMemory: Direct from: 0x140120A3CJump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read writeJump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 323010Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 3FC010Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeProcess created: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720 Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00491719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,1_2_00491719
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00493A5F AllocateAndInitializeSid,CheckTokenMembership,1_2_00493A5F
Source: AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0047EC07 cpuid 1_2_0047EC07
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00464EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,1_2_00464EDF
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00456037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,1_2_00456037
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_004561DF GetUserNameW,GetLastError,1_2_004561DF
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_0049887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,1_2_0049887B
Source: C:\Users\user\Desktop\1wrLmYiC62.exeCode function: 1_2_00455195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,1_2_00455195
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13BE0 sqlite3_bind_int,3_2_00E13BE0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13BC0 sqlite3_bind_parameter_count,3_2_00E13BC0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13CA0 sqlite3_bind_text,3_2_00E13CA0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13C70 sqlite3_bind_double,3_2_00E13C70
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13C40 sqlite3_bind_int64,3_2_00E13C40
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13C10 sqlite3_bind_int,3_2_00E13C10
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13DC0 sqlite3_bind_blob,3_2_00E13DC0
Source: C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exeCode function: 3_2_00E13E10 sqlite3_bind_null,3_2_00E13E10

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Native API		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		OS Credential Dumping12
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts3
Command and Scripting Interpreter		1
Windows Service		11
DLL Side-Loading		1
Abuse Elevation Control Mechanism		LSASS Memory1
Account Discovery		Remote Desktop ProtocolData from Removable Media2
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		Logon Script (Windows)1
Access Token Manipulation		3
Obfuscated Files or Information		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Windows Service		1
Software Packing		NTDS135
System Information Discovery		Distributed Component Object ModelInput Capture1
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script213
Process Injection		11
DLL Side-Loading		LSA Secrets231
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
File Deletion		Cached Domain Credentials2
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Masquerading		DCSync11
Virtualization/Sandbox Evasion		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Virtualization/Sandbox Evasion		Proc Filesystem1
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Access Token Manipulation		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron213
Process Injection		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1586714 Sample: 1wrLmYiC62.exe Startdate: 09/01/2025 Architecture: WINDOWS Score: 84 72 tataragirld.site 2->72 86 Multi AV Scanner detection for dropped file 2->86 88 Multi AV Scanner detection for submitted file 2->88 90 Machine Learning detection for dropped file 2->90 92 AI detected suspicious sample 2->92 11 1wrLmYiC62.exe 3 2->11         started        14 AdobeSync.exe 1 2->14         started        signatures3 process4 file5 66 C:\Windows\Temp\...\1wrLmYiC62.exe, PE32 11->66 dropped 17 1wrLmYiC62.exe 15 11->17         started        68 C:\Users\user\AppData\Local\Temp\28aeb7be, DOS 14->68 dropped 108 Maps a DLL or memory area into another process 14->108 110 Found direct / indirect Syscall (likely to bypass EDR) 14->110 21 cmd.exe 2 14->21         started        signatures6 process7 file8 44 C:\Windows\Temp\...\sqlite.dll, PE32 17->44 dropped 46 C:\Windows\Temp\...\Quadruple.dll, PE32 17->46 dropped 48 C:\Windows\Temp\...\BIB.dll, PE32 17->48 dropped 52 4 other files (2 malicious) 17->52 dropped 80 Multi AV Scanner detection for dropped file 17->80 23 AdobeSync.exe 9 17->23         started        50 C:\Users\user\AppData\Local\Temp\rgwqvdw, PE32+ 21->50 dropped 82 Writes to foreign memory regions 21->82 84 Maps a DLL or memory area into another process 21->84 27 LocalCtrl_alpha_v3.exe 21->27         started        29 conhost.exe 21->29         started        signatures9 process10 file11 58 C:\Users\user\AppData\Roaming\...\sqlite.dll, PE32 23->58 dropped 60 C:\Users\user\AppData\Roaming\...\BIB.dll, PE32 23->60 dropped 62 C:\Users\user\AppData\...\AdobeSync.exe, PE32 23->62 dropped 64 3 other files (1 malicious) 23->64 dropped 104 Switches to a custom stack to bypass stack traces 23->104 106 Found direct / indirect Syscall (likely to bypass EDR) 23->106 31 AdobeSync.exe 1 23->31         started        signatures12 process13 file14 70 C:\Users\user\AppData\Local\Temp\12adf363, DOS 31->70 dropped 74 Maps a DLL or memory area into another process 31->74 76 Switches to a custom stack to bypass stack traces 31->76 78 Found direct / indirect Syscall (likely to bypass EDR) 31->78 35 cmd.exe 5 31->35         started        signatures15 process16 file17 54 C:\Users\user\AppData\Local\Temp\utxcagya, PE32+ 35->54 dropped 56 C:\Users\user\...\LocalCtrl_alpha_v3.exe, PE32+ 35->56 dropped 94 Writes to foreign memory regions 35->94 96 Found hidden mapped module (file has been removed from disk) 35->96 98 Maps a DLL or memory area into another process 35->98 100 Switches to a custom stack to bypass stack traces 35->100 39 LocalCtrl_alpha_v3.exe 35->39         started        42 conhost.exe 35->42         started        signatures18 process19 signatures20 102 Found direct / indirect Syscall (likely to bypass EDR) 39->102

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
1wrLmYiC62.exe45%ReversingLabsWin32.Trojan.Rugmi

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\utxcagya100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\rgwqvdw100%Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\rgwqvdw24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Local\Temp\utxcagya24%ReversingLabsWin64.Trojan.Ulise
C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll0%ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll0%ReversingLabs
C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe45%ReversingLabsWin32.Trojan.Rugmi
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AXE8SharedExpat.dll30%ReversingLabsWin32.Trojan.Generic
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe0%ReversingLabs
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\BIB.dll0%ReversingLabs
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\Quadruple.dll0%ReversingLabs
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcp90.dll0%ReversingLabs
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dll0%ReversingLabs
C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\sqlite.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.softwareok.de/?Download=Find.Same.Images.OK0%Avira URL Cloudsafe
http://schemas.microsoft.cA0%Avira URL Cloudsafe
https://tataragirld.site:443W0%Avira URL Cloudsafe
https://tataragirld.site/9k.0%Avira URL Cloudsafe
https://tataragirld.site/=k0%Avira URL Cloudsafe
https://tataragirld.site:443Q0%Avira URL Cloudsafe
https://tataragirld.site/yj0%Avira URL Cloudsafe
https://tataragirld.site/R%0%Avira URL Cloudsafe
https://tataragirld.site/V%0%Avira URL Cloudsafe
https://tataragirld.site/w%0%Avira URL Cloudsafe
https://tataragirld.site/.%0%Avira URL Cloudsafe
https://tataragirld.site/Qj0%Avira URL Cloudsafe
https://tataragirld.site/C%0%Avira URL Cloudsafe
http://www.???.xx/?search=%s0%Avira URL Cloudsafe
https://tataragirld.site/Ej0%Avira URL Cloudsafe
https://tataragirld.site/f%0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK0%Avira URL Cloudsafe
https://tataragirld.site/n%0%Avira URL Cloudsafe
https://tataragirld.site/0%Avira URL Cloudsafe
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=00%Avira URL Cloudsafe
https://tataragirld.site:443NC0%Avira URL Cloudsafe
https://tataragirld.site/aj0%Avira URL Cloudsafe
https://tataragirld.site/J%0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_Englan0%Avira URL Cloudsafe
http://www.softwareok.de0%Avira URL Cloudsafe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History0%Avira URL Cloudsafe
https://tataragirld.site/2009_New_England_Patriots_season?om0%Avira URL Cloudsafe
https://tataragirld.site/5k0%Avira URL Cloudsafe
http://www.surfok.de/0%Avira URL Cloudsafe
https://tataragirld.site:4430%Avira URL Cloudsafe
https://tataragirld.site/)k0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
tataragirld.site
unknown
unknownfalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://tataragirld.site:443WLocalCtrl_alpha_v3.exe, 0000000A.00000003.1973034940.0000000000541000.00000004.00000020.00020000.00000000.sdmpfalse
    • Avira URL Cloud: safe
    		unknown
    http://www.vmware.com/0AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpfalse
      		high
      http://www.softwareok.com/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
        		high
        https://tataragirld.site/R%LocalCtrl_alpha_v3.exe, 00000010.00000003.2250932519.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://www.softwareok.com/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
          		high
          https://tataragirld.site:443QLocalCtrl_alpha_v3.exe, 0000000A.00000002.1986258096.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983503387.0000000000588000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.softwareok.de/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://schemas.microsoft.cA1wrLmYiC62.exe, 00000001.00000002.1502604585.000000000127E000.00000004.00000020.00020000.00000000.sdmp, 1wrLmYiC62.exe, 00000001.00000003.1502110806.000000000127B000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/=kLocalCtrl_alpha_v3.exe, 0000000A.00000003.1977287618.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/w%LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/V%LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/yjLocalCtrl_alpha_v3.exe, 0000000A.00000003.1974423173.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1973034940.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://tataragirld.site/9k.LocalCtrl_alpha_v3.exe, 0000000A.00000003.1981613429.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983342658.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.vmware.com/0/AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
              		high
              https://tataragirld.site/.%LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://tataragirld.site/n%LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor1wrLmYiC62.exe, 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000001.00000000.1479351379.000000000049B000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.1482492391.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpfalse
                		high
                http://www.???.xx/?search=%sAdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://tataragirld.site/QjLocalCtrl_alpha_v3.exe, 0000000A.00000003.1971474122.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://tataragirld.site/C%LocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.symauth.com/cps0(AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://tataragirld.site/EjLocalCtrl_alpha_v3.exe, 0000000A.00000003.1974423173.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/f%LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.softwareok.de/?Freeware/Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975748989.0000000000566000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2250932519.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2239619941.0000000000482000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2241242942.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2249666097.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site:443NCLocalCtrl_alpha_v3.exe, 0000000A.00000003.1971065667.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1971474122.0000000000541000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://tataragirld.site/ajLocalCtrl_alpha_v3.exe, 0000000A.00000003.1977287618.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.symauth.com/rpa00AdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://tataragirld.site/r%LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      https://tataragirld.site/2009_New_EnglanLocalCtrl_alpha_v3.exe, 00000010.00000003.2241242942.0000000000460000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.softwareok.deAdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://tataragirld.site/v%LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2246373258.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2248148657.0000000000484000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2252539122.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        http://www.info-zip.org/AdobeSync.exe, 00000003.00000002.1509912216.0000000008164000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.0000000008066000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.00000000053C5000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.00000000025D6000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.00000000078AD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.000000000556E000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://tataragirld.site/YjLocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://www.softwareok.de/?Freeware/Find.Same.Images.OK/HistoryLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://tataragirld.site/J%LocalCtrl_alpha_v3.exe, 00000010.00000003.2254289641.0000000000483000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://tataragirld.site/2009_New_England_Patriots_season?omLocalCtrl_alpha_v3.exe, 0000000A.00000002.1984224614.00000000004FC000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://tataragirld.site/5kLocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.softwareok.com/?Download=Find.Same.Images.OKLocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401F4000.00000002.00000001.01000000.00000014.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401F4000.00000002.00000001.01000000.00000014.sdmpfalse
                              		high
                              https://tataragirld.site/qjLocalCtrl_alpha_v3.exe, 0000000A.00000003.1975897904.000000000055F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1975982606.0000000000565000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                http://www.surfok.de/LocalCtrl_alpha_v3.exe, 00000010.00000002.2271686107.0000000140156000.00000002.00000001.01000000.00000014.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://tataragirld.site/)kLocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.000000000055F000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://tataragirld.site:443LocalCtrl_alpha_v3.exe, 0000000A.00000002.1986258096.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983503387.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1981949287.0000000000588000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1978655824.0000000000541000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000003.1983196049.0000000000588000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.softwareok.comAdobeSync.exe, 00000003.00000002.1509912216.00000000081BA000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.1571378245.00000000080BC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.1871199407.000000000540E000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000002.1987836904.000000000261F000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000A.00000000.1788076404.00000001401E0000.00000002.00000001.01000000.00000014.sdmp, AdobeSync.exe, 0000000B.00000002.1939705896.0000000007903000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2146296301.00000000055B7000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000002.2272053752.00000001401E0000.00000002.00000001.01000000.00000014.sdmpfalse
                                  		high
                                  https://tataragirld.site/F%LocalCtrl_alpha_v3.exe, 00000010.00000003.2243248705.000000000047F000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000010.00000003.2243509797.0000000000482000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://appsyndication.org/2006/appsyn1wrLmYiC62.exefalse
                                      		high

                                      World Map of Contacted IPs

                                      ⊘No contacted IP infos

                                      General Information

                                      Joe Sandbox version:42.0.0 Malachite
                                      Analysis ID:1586714
                                      Start date and time:2025-01-09 14:41:08 +01:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:0h 10m 16s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Number of analysed new started processes analysed:18
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Sample name:1wrLmYiC62.exe
                                      renamed because original name is a hash value
                                      Original Sample Name:dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5.exe
                                      Detection:MAL
                                      Classification:mal84.evad.winEXE@18/26@2/0
                                      EGA Information:
                                      • Successful, ratio: 50%
                                      HCA Information:
                                      • Successful, ratio: 99%
                                      • Number of executed functions: 102
                                      • Number of non-executed functions: 277
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
                                      • Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
                                      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                      • Execution Graph export aborted for target AdobeSync.exe, PID 7992 because there are no executed function
                                      • Execution Graph export aborted for target AdobeSync.exe, PID 8028 because there are no executed function
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • VT rate limit hit for: 1wrLmYiC62.exe

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      08:42:26API Interceptor1x Sleep call for process: 1wrLmYiC62.exe modified
                                      08:43:06API Interceptor41x Sleep call for process: LocalCtrl_alpha_v3.exe modified
                                      14:42:43AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT8F9C.tmp
                                      14:42:56AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helpmonitorv3.lnk

                                      Joe Sandbox View / Context

                                      IPs

                                      ⊘No context

                                      Domains

                                      ⊘No context

                                      ASNs

                                      ⊘No context

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.execLm7ThwEvh.msiGet hashmaliciousUnknownBrowse
                                        LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                          w3245.exeGet hashmaliciousUnknownBrowse
                                            w3245.exeGet hashmaliciousUnknownBrowse
                                              9mauyKC3JW.exeGet hashmaliciousUnknownBrowse
                                                ATLEQQXO.exeGet hashmaliciousUnknownBrowse
                                                  ATLEQQXO.exeGet hashmaliciousUnknownBrowse
                                                    upgrade.htaGet hashmaliciousDarkVision RatBrowse
                                                      MiJZ3z4t5K.exeGet hashmaliciousUnknownBrowse
                                                        UolJwovI8c.exeGet hashmaliciousUnknownBrowse

                                                          Created / dropped Files

                                                          C:\Users\user\AppData\Local\Temp\12adf363

                                                          Download File
                                                          Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                          File Type:DOS executable (COM)
                                                          Category:dropped
                                                          Size (bytes):5661033
                                                          Entropy (8bit):7.750680132824845
                                                          Encrypted:false
                                                          SSDEEP:98304:lHM+Ibk3YlgCzA0um4UBCJK9ar+YXiiHljImfGqqE2+F9Ekw5Ocl0OVhFH67ss/m:ibk3YDA019SZF3f+fOc6sO/f73q
                                                          MD5:4B40059BDFE752B39F4B73BB6A17EE93
                                                          SHA1:885E92B0590B877C644A860FBD00FEE2BF52E334
                                                          SHA-256:80DCFD5D02B3998F402C3288647F0039590C5C695D711E146143AEB77CB675DC
                                                          SHA-512:089253C4E9707EC8044F2CDA98F77A8A773F3CC0AE1235AA8B8D9F580F7D21914BC4D0F37D6239F3866D2BC040199E1B812147FDEC86C2D1C632AEF80D82685C
                                                          Malicious:true
                                                          Preview:.._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._...^..S..S...N..`0.t+.{1.e,.f>.2..g..}8..,.f>.g/..._..._..._..._..._..._..._..._..._..._..._..}..f6.{%.j_..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..}..s+.|,.|<..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..E..[..._6.},.fq.F...s2.}-..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._.. q..'o..%_..._..._..._..._..._..._..._..._..._..._.

                                                          C:\Users\user\AppData\Local\Temp\28aeb7be

                                                          Download File
                                                          Process:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                          File Type:DOS executable (COM)
                                                          Category:dropped
                                                          Size (bytes):5661033
                                                          Entropy (8bit):7.750680388008154
                                                          Encrypted:false
                                                          SSDEEP:98304:bHM+Ibk3YlgCzA0um4UBCJK9ar+YXiiHljImfGqqE2+F9Ekw5Ocl0OVhFH67ss/m:8bk3YDA019SZF3f+fOc6sO/f73q
                                                          MD5:495F5631BF34E4AE342167F788800B90
                                                          SHA1:BFEF1FC8DE36924F4576F2104E9F60402664DCD4
                                                          SHA-256:47C117FF5545DB59A4306155DB5A417940ED5B99F5DD9D1DE227DA60B7123232
                                                          SHA-512:52CE8717254F504AEA0EB42D68AA7E00367BB568EE582A374712BB72E998CA7B06294130E8D902D8C9E055D345562602E229EB0649EF0F7EC27808B318BB8643
                                                          Malicious:true
                                                          Preview:.._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._...^..S..S...N..`0.t+.{1.e,.f>.2..g..}8..,.f>.g/..._..._..._..._..._..._..._..._..._..._..._..}..f6.{%.j_..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..}..s+.|,.|<..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..E..[..._6.},.fq.F...s2.}-..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._..._.. q..'o..%_..._..._..._..._..._..._..._..._..._..._.

                                                          C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):2364728
                                                          Entropy (8bit):6.606009669324617
                                                          Encrypted:false
                                                          SSDEEP:49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
                                                          MD5:967F4470627F823F4D7981E511C9824F
                                                          SHA1:416501B096DF80DDC49F4144C3832CF2CADB9CB2
                                                          SHA-256:B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
                                                          SHA-512:8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Joe Sandbox View:
                                                          • Filename: cLm7ThwEvh.msi, Detection: malicious, Browse
                                                          • Filename: LVkAi4PBv6.exe, Detection: malicious, Browse
                                                          • Filename: w3245.exe, Detection: malicious, Browse
                                                          • Filename: w3245.exe, Detection: malicious, Browse
                                                          • Filename: 9mauyKC3JW.exe, Detection: malicious, Browse
                                                          • Filename: ATLEQQXO.exe, Detection: malicious, Browse
                                                          • Filename: ATLEQQXO.exe, Detection: malicious, Browse
                                                          • Filename: upgrade.hta, Detection: malicious, Browse
                                                          • Filename: MiJZ3z4t5K.exe, Detection: malicious, Browse
                                                          • Filename: UolJwovI8c.exe, Detection: malicious, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Temp\Scabbard_20250109084226.log

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):968
                                                          Entropy (8bit):5.444946668167272
                                                          Encrypted:false
                                                          SSDEEP:24:3NfbAIeLLznmKdrrFXcP2Y0XcP2xXcP23D5XcP2pXcP2W:3NDxYnmKNrFqf0qOqwNqaq1
                                                          MD5:A458C8568DA72D7B58FFAFB3E25A8701
                                                          SHA1:0744ED1E900552FB08AE9050DE9AC8589E3006EF
                                                          SHA-256:69646AE9B5652DDDBD3E16F583DF1D186949AFAB326C7BAC1B0922F2F28C4206
                                                          SHA-512:B4E433AC632730BAFB0A26877BC4FE8C77161263A566DFE829F59D14EF3E4EA646B0D3E31339FE61FA52A1B36590BCAAFDE1DAFEC1E8F459DA5D2DE524282D7A
                                                          Malicious:false
                                                          Preview:[1F18:1F1C][2025-01-09T08:42:26]i001: Burn v3.11.1.2318, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe..[1F18:1F1C][2025-01-09T08:42:26]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\1wrLmYiC62.exe -burn.filehandle.attached=716 -burn.filehandle.self=720'..[1F18:1F1C][2025-01-09T08:42:26]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\1wrLmYiC62.exe'..[1F18:1F1C][2025-01-09T08:42:26]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[1F18:1F1C][2025-01-09T08:42:26]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\Scabbard_20250109084226.log'..[1F18:1F1C][2025-01-09T08:42:26]i000: Setting string variable 'WixBundleName' to value 'Scabbard'..[1F18:1F1C][2025-01-09T08:42:26]i000: Setting string variable 'WixBundleManufacturer' to value 'Ravine'..

                                                          C:\Users\user\AppData\Local\Temp\payyyvinnqb

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 9 12:42:27 2025, mtime=Thu Jan 9 12:42:28 2025, atime=Fri Jan 3 12:50:46 2025, length=1219488, window=hide
                                                          Category:dropped
                                                          Size (bytes):920
                                                          Entropy (8bit):5.034017551078421
                                                          Encrypted:false
                                                          SSDEEP:12:8zkItIKK4MlSYChGlZY//p1IL+X/slGHAe2RRlkg8hUAjA1NH+yJ6gHAe2RygO8+:8hMRvSB8+UcHAeYRqBA2yUgHAeYyghm
                                                          MD5:3DF52330F7A44D4E887C11524ECB9621
                                                          SHA1:3A37F5CFF865BD1155B7E1818E391ED7B671D85F
                                                          SHA-256:2A4A115406772FE82B1A64E3F5D2F57225BF1156F05D02E514653B5A9FD0BE3A
                                                          SHA-512:A2E51F9AB7B4BCADD9002B8AFD6397BB16F183815BDA93442DFC05EF017CA5A98669F4A96FDE845B9580CC75D51822D10F18BB169A2A0757FBFF8492D4181D3B
                                                          Malicious:false
                                                          Preview:L..................F.... ....V.R.b.....R.b.....}.]............................:..DG..Yr?.D..U..k0.&...&.........5q....WU@.b....Y.b......t...CFSF..1.....EW)N..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)N)ZMm...........................c..A.p.p.D.a.t.a...B.V.1.....)ZNm..Roaming.@......EW)N)ZOm..........................l...R.o.a.m.i.n.g.....f.1.....)ZOm..PATCHR~1..N......)ZNm)ZOm............................!.P.a.t.c.h.R.e.a.d.e.r.W.C.F.....h.2.....#ZWn .ADOBES~1.EXE..L......)ZNm)ZNm..............................A.d.o.b.e.S.y.n.c...e.x.e.......i...............-.......h............K.1.....C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe..*.....\.....\.R.o.a.m.i.n.g.\.P.a.t.c.h.R.e.a.d.e.r.W.C.F.\.A.d.o.b.e.S.y.n.c...e.x.e.`.......X.......065367...........hT..CrF.f4... .a1..jc...+...E...hT..CrF.f4... .a1..jc...+...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                          C:\Users\user\AppData\Local\Temp\rgwqvdw

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                          File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                          Category:dropped
                                                          Size (bytes):2564608
                                                          Entropy (8bit):6.715211244010203
                                                          Encrypted:false
                                                          SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                          MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                          SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                          SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                          SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          • Antivirus: ReversingLabs, Detection: 24%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                          C:\Users\user\AppData\Local\Temp\utxcagya

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                          File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                          Category:dropped
                                                          Size (bytes):2564608
                                                          Entropy (8bit):6.715211244010203
                                                          Encrypted:false
                                                          SSDEEP:49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
                                                          MD5:2B37DF2D59558C43AB3A09B85A42C9D5
                                                          SHA1:7595E1B746FDD08F8F39906EF39DE1B249046D67
                                                          SHA-256:E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
                                                          SHA-512:CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                          • Antivirus: ReversingLabs, Detection: 24%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):168960
                                                          Entropy (8bit):6.635989544957891
                                                          Encrypted:false
                                                          SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                          MD5:77610CBDCAC173785E2FB18CCB522574
                                                          SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                          SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                          SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 30%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):1219488
                                                          Entropy (8bit):6.312582930861741
                                                          Encrypted:false
                                                          SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                          MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                          SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                          SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                          SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):110472
                                                          Entropy (8bit):6.411600464209584
                                                          Encrypted:false
                                                          SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                          MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                          SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                          SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                          SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\choirgirl.pdf

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):62969
                                                          Entropy (8bit):4.539146899101455
                                                          Encrypted:false
                                                          SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                          MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                          SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                          SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                          SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                          Malicious:false
                                                          Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\intermixture.zip

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):4526833
                                                          Entropy (8bit):7.959653744732072
                                                          Encrypted:false
                                                          SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                          MD5:3085505DB1512B966530B829E136BDCF
                                                          SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                          SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                          SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                          Malicious:false
                                                          Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):570496
                                                          Entropy (8bit):6.5259314477231305
                                                          Encrypted:false
                                                          SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                          MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                          SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                          SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                          SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                          Malicious:false
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):653952
                                                          Entropy (8bit):6.885961951552677
                                                          Encrypted:false
                                                          SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                          MD5:11D49148A302DE4104DED6A92B78B0ED
                                                          SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                          SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                          SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                          Malicious:false
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):249232
                                                          Entropy (8bit):6.822042592978165
                                                          Encrypted:false
                                                          SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                          MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                          SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                          SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                          SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe

                                                          Download File
                                                          Process:C:\Users\user\Desktop\1wrLmYiC62.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):6305325
                                                          Entropy (8bit):7.9787714785946955
                                                          Encrypted:false
                                                          SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
                                                          MD5:9C540950F5A8981844FF33BFC55D2F36
                                                          SHA1:8C70F2BCB995CE313843CF7103C659C12EB263DC
                                                          SHA-256:DD53AC67D905DEFD4BD1F2B9B413DFC679E7C076E92792BE650C38659E1557C5
                                                          SHA-512:7D87E02B60647134758F4C20BDB18A1DEF78BC9B69D337B6EE6D9B190968749D028479D0F6758CDFD8C76DF454F7AE68395A4EBDCB6D99CEA5B0B48CD5BA685B
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 45%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z..........................................@.......................................@..................................................................`...=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=...`...>..."..............@..B................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AXE8SharedExpat.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):168960
                                                          Entropy (8bit):6.635989544957891
                                                          Encrypted:false
                                                          SSDEEP:3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
                                                          MD5:77610CBDCAC173785E2FB18CCB522574
                                                          SHA1:315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
                                                          SHA-256:40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
                                                          SHA-512:AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 30%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):1219488
                                                          Entropy (8bit):6.312582930861741
                                                          Encrypted:false
                                                          SSDEEP:24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
                                                          MD5:F778E9136AB0DB9DE9802A7043DE50A7
                                                          SHA1:850DCA074534A14FDB9ADA6AFACEEA88558764E0
                                                          SHA-256:90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
                                                          SHA-512:CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\BIB.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):110472
                                                          Entropy (8bit):6.411600464209584
                                                          Encrypted:false
                                                          SSDEEP:3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
                                                          MD5:759D71FC9442AB5A9B5749C0F6C0C263
                                                          SHA1:07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
                                                          SHA-256:109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
                                                          SHA-512:E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............|..............@..B................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\BootstrapperApplicationData.xml

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (473), with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):2006
                                                          Entropy (8bit):3.7572989677816073
                                                          Encrypted:false
                                                          SSDEEP:48:y+03qHhhO7YDTT3ne1REDHV5JC0wNqycUbTXRC+bLqihGrWrol:Xn7n6q80wMycsRCDKGrN
                                                          MD5:ADBA259B1418C9ED84277688BFEEFAA7
                                                          SHA1:A6EF522036403047FF578DEF1E0AFD616A277357
                                                          SHA-256:6DF90329C4E3DF98DBB91556C98CDB46CD0258B49A500999284096A9DF972BDA
                                                          SHA-512:9F90BD3C1892CE45870DE3FEC0F83516E5B61C1774024C03EC2BCDAEB7C8AC1F05536BF0403C77F520D8D39C0ACBE11769A32A3FE49571B71F1D4DCC5FCFFE66
                                                          Malicious:false
                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".S.c.a.b.b.a.r.d.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.5.c.6.7.9.b.6.d.-.9.8.d.4.-.4.b.7.8.-.9.6.0.a.-.1.8.2.1.c.9.2.2.7.4.d.b.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.6.C.D.E.7.8.E.C.-.4.C.1.C.-.4.6.A.B.-.B.B.E.9.-.9.7.4.6.B.E.0.D.7.F.8.6.}.". .P.e.r.M.a.c.h.i.n.e.=.".n.o.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".S.l.u.i.t.". .V.i.t.a.l.=.".y.e.s.". .D.i.s.p.l.a.y.N.a.m.e.=.".P.y.t.h.o.n. .3...1.2...5. .E.x.e.c.u.t.a.b.l.e.s. .(.6.4.-.b.i.t.).". .D.o.w.n.l.o.a.d.S.i.z.e.=.".7.4.1.3.7.6.". .P.a.c.k.a.g.e.S.i.z.e.=.".7.4.1.3.7.6.".

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\Quadruple.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):255392
                                                          Entropy (8bit):6.5751135995470245
                                                          Encrypted:false
                                                          SSDEEP:6144:z7qdWWmoR0sztnfGIUbmUL1ueM+d9euhAOZD3FCP3z:Sssztnfu9ueM+doKX4P3z
                                                          MD5:7C95B91566BA5A2D8BF70C2BCF13D712
                                                          SHA1:B01F54AE2964480B8AEB2817285219AB8A2C79C0
                                                          SHA-256:39230D24CF7602FF2B00A7FF13BA5160B9B3446FBA7C6F6295DD4FB2EB408DF5
                                                          SHA-512:AB70A77C05EC42B77166D2E7FC81B18AD390E2CB32249F35355AFD4271AEDCFBDE882992AE0E84A9F95453CB9FD05AE224713EE3FDA93BABC6C9CFB572B50FAD
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.o.1.o.1.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1.o.1.o.1...0.o.1...0.o.1..W1.o.1.o?1.o.1...0.o.1Rich.o.1................PE..L...C.3`.........."!.........R......................................................~.....@......................... .......,...x.......p........................(...`..p...................@a......p...@...................<...@....................text............................... ..`.rdata..N...........................@..@.data...............................@....rsrc...p...........................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\choirgirl.pdf

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):62969
                                                          Entropy (8bit):4.539146899101455
                                                          Encrypted:false
                                                          SSDEEP:1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
                                                          MD5:9076AB572C60AAB6B113F4F9108A9CC8
                                                          SHA1:1439248640CE9418B5BA13862160DFA00364390B
                                                          SHA-256:1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
                                                          SHA-512:B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
                                                          Malicious:false
                                                          Preview:t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\intermixture.zip

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):4526833
                                                          Entropy (8bit):7.959653744732072
                                                          Encrypted:false
                                                          SSDEEP:98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
                                                          MD5:3085505DB1512B966530B829E136BDCF
                                                          SHA1:C105A4CB691CC2302878C71BE8D375E4018CDB29
                                                          SHA-256:2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
                                                          SHA-512:5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
                                                          Malicious:false
                                                          Preview:luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcp90.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):570496
                                                          Entropy (8bit):6.5259314477231305
                                                          Encrypted:false
                                                          SSDEEP:12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
                                                          MD5:90A32D8E07F7FB3D102EAB1DA28F0723
                                                          SHA1:0903911BBB5D00F68BA51895FA898B38A5453DED
                                                          SHA-256:004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
                                                          SHA-512:2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
                                                          Malicious:false
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\msvcr90.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):653952
                                                          Entropy (8bit):6.885961951552677
                                                          Encrypted:false
                                                          SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                          MD5:11D49148A302DE4104DED6A92B78B0ED
                                                          SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                          SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                          SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                          Malicious:false
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                          C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\sqlite.dll

                                                          Download File
                                                          Process:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):249232
                                                          Entropy (8bit):6.822042592978165
                                                          Encrypted:false
                                                          SSDEEP:6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
                                                          MD5:596439B3A9F9EA44FF28E2974F69AB07
                                                          SHA1:A2074CD3D39045902F82A072455420AB7101A036
                                                          SHA-256:8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
                                                          SHA-512:1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                          Static File Info

                                                          General

                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Entropy (8bit):7.9787714785946955
                                                          TrID:
                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                          • DOS Executable Generic (2002/1) 0.02%
                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                          File name:1wrLmYiC62.exe
                                                          File size:6'305'325 bytes
                                                          MD5:9c540950f5a8981844ff33bfc55d2f36
                                                          SHA1:8c70f2bcb995ce313843cf7103c659c12eb263dc
                                                          SHA256:dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5
                                                          SHA512:7d87e02b60647134758f4c20bdb18a1def78bc9b69d337b6ee6d9b190968749d028479d0f6758cdfd8c76df454f7ae68395a4ebdcb6d99cea5b0b48cd5ba685b
                                                          SSDEEP:196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
                                                          TLSH:E1562332A5614033D7F206B3AD6891347EBCEF28175099A9E3D4BD1D6EB40923BB7253
                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@.......@......y@.......@..."|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@.

                                                          File Icon

                                                          Icon Hash:a9e8e8e9e8e8e8a9

                                                          Static PE Info

                                                          General

                                                          Entrypoint:0x42e2a6
                                                          Entrypoint Section:.text
                                                          Digitally signed:false
                                                          Imagebase:0x400000
                                                          Subsystem:windows gui
                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                          Time Stamp:0x5A10AD86 [Sat Nov 18 22:00:38 2017 UTC]
                                                          TLS Callbacks:
                                                          CLR (.Net) Version:
                                                          OS Version Major:5
                                                          OS Version Minor:1
                                                          File Version Major:5
                                                          File Version Minor:1
                                                          Subsystem Version Major:5
                                                          Subsystem Version Minor:1
                                                          Import Hash:d7e2fd259780271687ffca462b9e69b7

                                                          Entrypoint Preview

                                                          Instruction
                                                          call 00007FD08510525Fh
                                                          jmp 00007FD085104BD3h
                                                          mov eax, dword ptr [esp+08h]
                                                          mov ecx, dword ptr [esp+10h]
                                                          or ecx, eax
                                                          mov ecx, dword ptr [esp+0Ch]
                                                          jne 00007FD085104D4Bh
                                                          mov eax, dword ptr [esp+04h]
                                                          mul ecx
                                                          retn 0010h
                                                          push ebx
                                                          mul ecx
                                                          mov ebx, eax
                                                          mov eax, dword ptr [esp+08h]
                                                          mul dword ptr [esp+14h]
                                                          add ebx, eax
                                                          mov eax, dword ptr [esp+08h]
                                                          mul ecx
                                                          add edx, ebx
                                                          pop ebx
                                                          retn 0010h
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          int3
                                                          cmp cl, 00000040h
                                                          jnc 00007FD085104D57h
                                                          cmp cl, 00000020h
                                                          jnc 00007FD085104D48h
                                                          shrd eax, edx, cl
                                                          shr edx, cl
                                                          ret
                                                          mov eax, edx
                                                          xor edx, edx
                                                          and cl, 0000001Fh
                                                          shr eax, cl
                                                          ret
                                                          xor eax, eax
                                                          xor edx, edx
                                                          ret
                                                          push ebp
                                                          mov ebp, esp
                                                          jmp 00007FD085104D4Fh
                                                          push dword ptr [ebp+08h]
                                                          call 00007FD08510B5CCh
                                                          pop ecx
                                                          test eax, eax
                                                          je 00007FD085104D51h
                                                          push dword ptr [ebp+08h]
                                                          call 00007FD08510B655h
                                                          pop ecx
                                                          test eax, eax
                                                          je 00007FD085104D28h
                                                          pop ebp
                                                          ret
                                                          cmp dword ptr [ebp+08h], FFFFFFFFh
                                                          je 00007FD0851055E4h
                                                          jmp 00007FD0851055C1h
                                                          push ebp
                                                          mov ebp, esp
                                                          push dword ptr [ebp+08h]
                                                          call 00007FD0851055FDh
                                                          pop ecx
                                                          pop ebp
                                                          ret
                                                          push ebp
                                                          mov ebp, esp
                                                          test byte ptr [ebp+08h], 00000001h
                                                          push esi
                                                          mov esi, ecx
                                                          mov dword ptr [esi], 00460DB8h
                                                          je 00007FD085104D4Ch
                                                          push 0000000Ch
                                                          push esi
                                                          call 00007FD085104D1Dh
                                                          pop ecx
                                                          pop ecx
                                                          mov eax, esi
                                                          pop esi
                                                          pop ebp

                                                          Rich Headers

                                                          Programming Language:
                                                          • [ C ] VS2008 SP1 build 30729
                                                          • [IMP] VS2008 SP1 build 30729

                                                          Data Directories

                                                          NameVirtual AddressVirtual Size Is in Section
                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x686b40xb4.rdata
                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x6d0000x189ac.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x860000x3dfc.reloc
                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x676500x54.rdata
                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_TLS0x676a40x18.rdata
                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x670300x40.rdata
                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IAT0x4b0000x3e0.rdata
                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x682340x100.rdata
                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                          Sections

                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                          .text0x10000x499370x49a002319c0baa707bb66cc0bc08c55a13d8cFalse0.5314688561120543data6.570006046413636IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                          .rdata0x4b0000x1ed600x1ee008ad6c4e18165c6d8ccdc97bab683438dFalse0.3136386639676113data5.114228301263695IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .data0x6a0000x17300xa0000fde973df27dc2d36084e16d6dddbdfFalse0.274609375firmware 2005 v9319 (revision 0) N\346@\273\261\031\277D V2, 0 bytes or less, UNKNOWN2 0xffffffff, at 0 0 bytes , at 0 0 bytes , at 0x20a146003.1526594027632213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .wixburn0x6c0000x380x2006a6fa226648aa5455d00e43308ab550fFalse0.107421875data0.5813091016060967IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .rsrc0x6d0000x189ac0x18a00768107f716c3d4350e9c7978a9a75946False0.6123790450507615data7.16247135144247IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .reloc0x860000x3dfc0x3e00dd2c47fa48872886af4c9a2e5bd90cccFalse0.8097278225806451data6.794335469567533IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                          Resources

                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                          RT_ICON0x6d2c80xaf05PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.00046869768999
                                                          RT_ICON0x781d00x4228Device independent bitmap graphic, 64 x 128 x 32, image size 0EnglishUnited States0.2670642418516769
                                                          RT_ICON0x7c3f80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.3201244813278008
                                                          RT_ICON0x7e9a00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 0EnglishUnited States0.3479289940828402
                                                          RT_ICON0x804080x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3897748592870544
                                                          RT_ICON0x814b00x988Device independent bitmap graphic, 24 x 48 x 32, image size 0EnglishUnited States0.4389344262295082
                                                          RT_ICON0x81e380x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 0EnglishUnited States0.45290697674418606
                                                          RT_ICON0x824f00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.6338652482269503
                                                          RT_MESSAGETABLE0x829580x2840dataEnglishUnited States0.28823757763975155
                                                          RT_GROUP_ICON0x851980x76dataEnglishUnited States0.7203389830508474
                                                          RT_VERSION0x852100x2c8dataEnglishUnited States0.47752808988764045
                                                          RT_MANIFEST0x854d80x4d2XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminatorsEnglishUnited States0.47568881685575365

                                                          Imports

                                                          DLLImport
                                                          ADVAPI32.dllRegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DecryptFileW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
                                                          USER32.dllPeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
                                                          OLEAUT32.dllVariantInit, SysAllocString, VariantClear, SysFreeString
                                                          GDI32.dllDeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
                                                          SHELL32.dllCommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
                                                          ole32.dllCoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
                                                          KERNEL32.dllGetCommandLineA, GetCPInfo, GetOEMCP, CloseHandle, CreateFileW, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, FindClose, GetCommandLineW, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, GetCurrentProcess, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, FreeLibrary, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetNativeSystemInfo, GetModuleHandleExW, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetEnvironmentStringsW, VerifyVersionInfoW, GetVolumePathNameW, GetDateFormatW, GetUserDefaultUILanguage, GetSystemDefaultLangID, GetUserDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, InterlockedExchange, InterlockedCompareExchange, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, OpenProcess, GetProcessId, WaitForSingleObject, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, InterlockedIncrement, InterlockedDecrement, ResetEvent, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, CreateFileMappingW, GetThreadLocale, IsValidCodePage, FindFirstFileExW, FreeEnvironmentStringsW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DecodePointer, WriteConsoleW, GetModuleHandleA, GlobalAlloc, GlobalFree, GetFileSizeEx, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetComputerNameW, SetCurrentDirectoryW, GetFileType, GetACP, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, LoadLibraryExA
                                                          RPCRT4.dllUuidCreate

                                                          Possible Origin

                                                          Language of compilation systemCountry where language is spokenMap
                                                          EnglishUnited States

                                                          Network Behavior

                                                          Network Port Distribution

                                                          UDP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Jan 9, 2025 14:43:15.921396971 CET5957753192.168.2.101.1.1.1
                                                          Jan 9, 2025 14:43:15.930252075 CET53595771.1.1.1192.168.2.10
                                                          Jan 9, 2025 14:43:42.896738052 CET6408253192.168.2.101.1.1.1
                                                          Jan 9, 2025 14:43:42.904097080 CET53640821.1.1.1192.168.2.10

                                                          DNS Queries

                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                          Jan 9, 2025 14:43:15.921396971 CET192.168.2.101.1.1.10x1a39Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false
                                                          Jan 9, 2025 14:43:42.896738052 CET192.168.2.101.1.1.10xbdf3Standard query (0)tataragirld.siteA (IP address)IN (0x0001)false

                                                          DNS Answers

                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                          Jan 9, 2025 14:43:15.930252075 CET1.1.1.1192.168.2.100x1a39Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false
                                                          Jan 9, 2025 14:43:42.904097080 CET1.1.1.1192.168.2.100xbdf3Name error (3)tataragirld.sitenonenoneA (IP address)IN (0x0001)false

                                                          Statistics

                                                          CPU Usage

                                                          Click to jump to process

                                                          Memory Usage

                                                          Click to jump to process

                                                          High Level Behavior Distribution

                                                          Click to dive into process behavior distribution

                                                          Behavior

                                                          Click to jump to process

                                                          System Behavior

                                                          General

                                                          Target ID:1
                                                          Start time:08:42:25
                                                          Start date:09/01/2025
                                                          Path:C:\Users\user\Desktop\1wrLmYiC62.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\Desktop\1wrLmYiC62.exe"
                                                          Imagebase:0x450000
                                                          File size:6'305'325 bytes
                                                          MD5 hash:9C540950F5A8981844FF33BFC55D2F36
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:2
                                                          Start time:08:42:26
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=716 -burn.filehandle.self=720
                                                          Imagebase:0xc60000
                                                          File size:6'305'325 bytes
                                                          MD5 hash:9C540950F5A8981844FF33BFC55D2F36
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 45%, ReversingLabs
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:3
                                                          Start time:08:42:26
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Windows\Temp\{561AA9E1-B289-4385-89F8-F07407B1DAE2}\.ba\AdobeSync.exe
                                                          Imagebase:0xd50000
                                                          File size:1'219'488 bytes
                                                          MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 0%, ReversingLabs
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:4
                                                          Start time:08:42:28
                                                          Start date:09/01/2025
                                                          Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                          Imagebase:0xaa0000
                                                          File size:1'219'488 bytes
                                                          MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 0%, ReversingLabs
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:5
                                                          Start time:08:42:29
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Windows\SysWOW64\cmd.exe
                                                          Imagebase:0xd70000
                                                          File size:236'544 bytes
                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:6
                                                          Start time:08:42:29
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff620390000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:10
                                                          Start time:08:42:56
                                                          Start date:09/01/2025
                                                          Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                          Imagebase:0x140000000
                                                          File size:2'364'728 bytes
                                                          MD5 hash:967F4470627F823F4D7981E511C9824F
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 0%, ReversingLabs
                                                          Reputation:moderate
                                                          Has exited:true

                                                          General

                                                          Target ID:11
                                                          Start time:08:43:04
                                                          Start date:09/01/2025
                                                          Path:C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
                                                          Imagebase:0xaa0000
                                                          File size:1'219'488 bytes
                                                          MD5 hash:F778E9136AB0DB9DE9802A7043DE50A7
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:12
                                                          Start time:08:43:06
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:C:\Windows\SysWOW64\cmd.exe
                                                          Imagebase:0xd70000
                                                          File size:236'544 bytes
                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:13
                                                          Start time:08:43:06
                                                          Start date:09/01/2025
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff620390000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:true

                                                          General

                                                          Target ID:16
                                                          Start time:08:43:24
                                                          Start date:09/01/2025
                                                          Path:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
                                                          Imagebase:0x140000000
                                                          File size:2'364'728 bytes
                                                          MD5 hash:967F4470627F823F4D7981E511C9824F
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Has exited:true

                                                          Disassembly

                                                          Reset < >

                                                            Executed Functions

                                                            Function 00453CC4 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 320fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 482 453cc4-453d51 call 47f8e0 * 2 GetFileAttributesW 487 453d85-453d88 482->487 488 453d53-453d5a GetLastError 482->488 489 4540d5 487->489 490 453d8e-453d91 487->490 491 453d5c-453d5e 488->491 492 453d5f-453d61 488->492 495 4540da-4540e3 489->495 496 453d93-453da6 SetFileAttributesW 490->496 497 453dca-453dd1 490->497 491->492 493 453d63-453d6c 492->493 494 453d6e 492->494 493->494 494->487 498 453d70-453d71 494->498 499 4540e5-4540e6 FindClose 495->499 500 4540ec-4540f3 495->500 496->497 501 453da8-453dae GetLastError 496->501 502 453de0-453de8 497->502 503 453dd3-453dda 497->503 507 453d76-453d80 call 453821 498->507 499->500 508 4540f5-4540fb call 495636 500->508 509 454100-454112 call 47e06f 500->509 510 453db0-453db9 501->510 511 453dbb 501->511 505 453e25-453e40 call 452d58 502->505 506 453dea-453dfe 502->506 503->502 504 454058 503->504 512 45405e-45406c RemoveDirectoryW 504->512 505->500 527 453e46-453e62 FindFirstFileW 505->527 506->505 524 453e00-453e06 GetLastError 506->524 507->500 508->509 510->511 517 453dc2-453dc8 511->517 518 453dbd 511->518 512->495 520 45406e-454074 GetLastError 512->520 517->507 518->517 525 454076-454079 520->525 526 45407f-454085 520->526 528 453e13 524->528 529 453e08-453e11 524->529 525->526 530 454087-454089 526->530 531 4540a1-4540a3 526->531 532 453e64-453e6a GetLastError 527->532 533 453e89-453e93 527->533 536 453e15 528->536 537 453e1a-453e20 528->537 529->528 538 4540a5-4540ab 530->538 539 45408b-45409d MoveFileExW 530->539 531->495 531->538 540 453e77 532->540 541 453e6c-453e75 532->541 534 453e95-453e9e 533->534 535 453eba-453ee0 call 452d58 533->535 544 453ea4-453eab 534->544 545 453fbd-453fcd FindNextFileW 534->545 535->495 557 453ee6-453ef3 535->557 536->537 537->507 548 453ffa-454004 call 453821 538->548 539->538 547 45409f 539->547 542 453e7e-453e7f 540->542 543 453e79 540->543 541->540 542->533 543->542 544->535 550 453ead-453eb4 544->550 552 45404d-454052 GetLastError 545->552 553 453fcf-453fd5 545->553 547->531 548->495 550->535 550->545 554 454054-454056 552->554 555 4540b0-4540b6 GetLastError 552->555 553->533 554->512 560 4540c3 555->560 561 4540b8-4540c1 555->561 558 453ef5-453ef7 557->558 559 453f22-453f29 557->559 558->559 566 453ef9-453f09 call 452b0c 558->566 564 453fb7 559->564 565 453f2f-453f31 559->565 562 4540c5 560->562 563 4540ca-4540d0 560->563 561->560 562->563 563->548 564->545 567 453f33-453f46 SetFileAttributesW 565->567 568 453f4c-453f5a DeleteFileW 565->568 566->495 577 453f0f-453f18 call 453cc4 566->577 567->568 570 453fda-453fe0 GetLastError 567->570 568->564 571 453f5c-453f5e 568->571 573 453fe2-453feb 570->573 574 453fed 570->574 575 453f64-453f81 GetTempFileNameW 571->575 576 45402b-454031 GetLastError 571->576 573->574 579 453ff4-453ff5 574->579 580 453fef 574->580 581 453f87-453fa4 MoveFileExW 575->581 582 454009-45400f GetLastError 575->582 583 454033-45403c 576->583 584 45403e 576->584 585 453f1d 577->585 579->548 580->579 588 453fa6-453fad 581->588 589 453faf 581->589 586 454011-45401a 582->586 587 45401c 582->587 583->584 590 454045-45404b 584->590 591 454040 584->591 585->564 586->587 592 454023-454029 587->592 593 45401e 587->593 594 453fb5 MoveFileExW 588->594 589->594 590->548 591->590 592->548 593->592 594->564
                                                            APIs
                                                            • GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00453D40
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453D53
                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00453D9E
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453DA8
                                                            • GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00453DF6
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453E00
                                                            • FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00453E53
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453E64
                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00453F3E
                                                            • DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00453F52
                                                            • GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00453F79
                                                            • MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00453F9C
                                                            • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00453FB5
                                                            • FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00453FC5
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453FDA
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00454009
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 0045402B
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 0045404D
                                                            • RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00454064
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 0045406E
                                                            • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00454095
                                                            • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 004540B0
                                                            • FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 004540E6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
                                                            • String ID: 4Mw$*.*$DEL$dirutil.cpp
                                                            • API String ID: 1544372074-3821523967
                                                            • Opcode ID: 42583c24980efc3051b83630286077d387946e8a66583e37621663204f6f1a98
                                                            • Instruction ID: 778c3fcb3ef32e11a3f23626c7c0797f55b1ec8bc7515fd161ab65a0147d9299
                                                            • Opcode Fuzzy Hash: 42583c24980efc3051b83630286077d387946e8a66583e37621663204f6f1a98
                                                            • Instruction Fuzzy Hash: 3EB12F33D0113597DB305E648D05B9BB675AF40B57F1102A7EE08BB282D73A8E98CAD8
                                                            Function 00455195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 700 455195-455243 call 47f8e0 * 2 GetModuleHandleW call 4904f8 call 4906ae call 45120a 711 455245 700->711 712 455259-45526a call 4542d7 700->712 714 45524a-455254 call 490237 711->714 717 455273-45528f call 455618 CoInitializeEx 712->717 718 45526c-455271 712->718 720 4554d4-4554db 714->720 728 455291-455296 717->728 729 455298-4552a4 call 48fcae 717->729 718->714 722 4554dd-4554e3 call 495636 720->722 723 4554e8-4554ea 720->723 722->723 726 4554ec-4554f3 723->726 727 4554fa-455518 call 45d82f call 46a8d6 call 46ab24 723->727 726->727 730 4554f5 call 4641ec 726->730 750 455546-455559 call 454fa4 727->750 751 45551a-455522 727->751 728->714 737 4552a6 729->737 738 4552b8-4552c7 call 490e07 729->738 730->727 741 4552ab-4552b3 call 490237 737->741 745 4552d0-4552df call 492af7 738->745 746 4552c9-4552ce 738->746 741->720 756 4552e1-4552e6 745->756 757 4552e8-4552f7 call 493565 745->757 746->741 761 455560-455567 750->761 762 45555b call 493a35 750->762 751->750 752 455524-455527 751->752 752->750 755 455529-455544 call 46434c call 455602 752->755 755->750 756->741 769 455300-45531f GetVersionExW 757->769 770 4552f9-4552fe 757->770 766 45556e-455575 761->766 767 455569 call 492efe 761->767 762->761 772 455577 call 491479 766->772 773 45557c-455583 766->773 767->766 778 455321-45532b GetLastError 769->778 779 455359-45539e call 4533c7 call 455602 769->779 770->741 772->773 775 455585 call 48fdbd 773->775 776 45558a-45558c 773->776 775->776 782 455594-45559b 776->782 783 45558e CoUninitialize 776->783 784 45532d-455336 778->784 785 455338 778->785 802 4553b1-4553c1 call 46752a 779->802 803 4553a0-4553ab call 495636 779->803 787 4555d6-4555df call 490113 782->787 788 45559d-45559f 782->788 783->782 784->785 789 45533f-455354 call 453821 785->789 790 45533a 785->790 800 4555e6-4555ff call 490802 call 47e06f 787->800 801 4555e1 call 4545ee 787->801 794 4555a5-4555ab 788->794 795 4555a1-4555a3 788->795 789->741 790->789 799 4555ad-4555c6 call 463d85 call 455602 794->799 795->799 799->787 821 4555c8-4555d5 call 455602 799->821 801->800 815 4553c3 802->815 816 4553cd-4553d6 802->816 803->802 815->816 818 4553dc-4553df 816->818 819 45549e-4554ab call 454d39 816->819 823 4553e5-4553e8 818->823 824 455476-455492 call 454ae5 818->824 830 4554b0-4554b4 819->830 821->787 827 45544e-45546a call 4548ef 823->827 828 4553ea-4553ed 823->828 836 4554c0-4554d2 824->836 840 455494 824->840 827->836 842 45546c 827->842 832 455426-455442 call 454a88 828->832 833 4553ef-4553f2 828->833 835 4554b6 830->835 830->836 832->836 846 455444 832->846 838 4553f4-4553f9 833->838 839 455403-455416 call 454c86 833->839 835->836 836->720 838->839 839->836 847 45541c 839->847 840->819 842->824 846->827 847->832
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00455217
                                                              • Part of subcall function 004904F8: InitializeCriticalSection.KERNEL32(004BB5FC,?,00455223,00000000,?,?,?,?,?,?), ref: 0049050F
                                                              • Part of subcall function 0045120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0045523F,00000000,?), ref: 00451248
                                                              • Part of subcall function 0045120A: GetLastError.KERNEL32(?,?,?,0045523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00451252
                                                            • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00455285
                                                              • Part of subcall function 00490E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00490E28
                                                            • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00455317
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00455321
                                                            • CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0045558E
                                                            Strings
                                                            • 3.11.1.2318, xrefs: 00455384
                                                            • Failed to initialize COM., xrefs: 00455291
                                                            • Failed to initialize engine state., xrefs: 0045526C
                                                            • Failed to parse command line., xrefs: 00455245
                                                            • Failed to run per-machine mode., xrefs: 0045546C
                                                            • Failed to initialize Regutil., xrefs: 004552C9
                                                            • Failed to run per-user mode., xrefs: 00455494
                                                            • Invalid run mode., xrefs: 004553F9
                                                            • engine.cpp, xrefs: 00455345
                                                            • Failed to initialize core., xrefs: 004553C3
                                                            • Failed to initialize Wiutil., xrefs: 004552E1
                                                            • Failed to run untrusted mode., xrefs: 004554B6
                                                            • Failed to initialize Cryputil., xrefs: 004552A6
                                                            • Failed to initialize XML util., xrefs: 004552F9
                                                            • Failed to run RunOnce mode., xrefs: 0045541C
                                                            • Failed to get OS info., xrefs: 0045534F
                                                            • Failed to run embedded mode., xrefs: 00455444
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                            • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
                                                            • API String ID: 3262001429-510904028
                                                            • Opcode ID: a6c82d3559c92ba093f78215fa5de6d598e6d61d6eb11bb89c82fb717f387da0
                                                            • Instruction ID: d70be6e5ebf2fc71cde6b64a0ef64f722da7720bd873e9675228daa0338e6fd2
                                                            • Opcode Fuzzy Hash: a6c82d3559c92ba093f78215fa5de6d598e6d61d6eb11bb89c82fb717f387da0
                                                            • Instruction Fuzzy Hash: E7B1C471D40628ABCF21AA55CD56BFD7674AF44316F0001EBFD08A6242D7789E88CF99
                                                            Function 0049304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00493609,00000000,?,00000000), ref: 00493069
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0047C025,?,00455405,?,00000000,?), ref: 00493075
                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 004930B5
                                                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004930C1
                                                            • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 004930CC
                                                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 004930D6
                                                            • CoCreateInstance.OLE32(004BB6B8,00000000,00000001,0049B818,?,?,?,?,?,?,?,?,?,?,?,0047C025), ref: 00493111
                                                            • ExitProcess.KERNEL32 ref: 004931C0
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                            • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                            • API String ID: 2124981135-499589564
                                                            • Opcode ID: e0e8137396dda25d4a84d5e4c25bbba4a8496535d085d35f24fd62521991dc0c
                                                            • Instruction ID: 0017c9c4b8eaacdbc3a7f3eacacdc9dd07a951091424c6313c1b62de2e3b1dca
                                                            • Opcode Fuzzy Hash: e0e8137396dda25d4a84d5e4c25bbba4a8496535d085d35f24fd62521991dc0c
                                                            • Instruction Fuzzy Hash: FE41C535A01215ABCF24DFA88846BAFBBB4EF45712F11407BE901E7354DB79DE018B98
                                                            Function 00451070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 004533C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004510DD,?,00000000), ref: 004533E8
                                                            • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 004510F6
                                                              • Part of subcall function 00451175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 00451186
                                                              • Part of subcall function 00451175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 00451191
                                                              • Part of subcall function 00451175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0045119F
                                                              • Part of subcall function 00451175: GetLastError.KERNEL32(?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 004511BA
                                                              • Part of subcall function 00451175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004511C2
                                                              • Part of subcall function 00451175: GetLastError.KERNEL32(?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 004511D7
                                                            • CloseHandle.KERNELBASE(?,?,?,?,0049B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00451131
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                            • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                            • API String ID: 3687706282-3151496603
                                                            • Opcode ID: c5bd5c2842a89c76cc857dc3e6218318b724bb5078b99fb829657db61a76a146
                                                            • Instruction ID: df97e93657b1180fb77ac7eacfc83966f9cd0a9968580ac46887497762126810
                                                            • Opcode Fuzzy Hash: c5bd5c2842a89c76cc857dc3e6218318b724bb5078b99fb829657db61a76a146
                                                            • Instruction Fuzzy Hash: 9221877190061CABCF109FA5DD45BDE7FB4EB08715F10816AED10B7292D77859088BE8
                                                            Function 0046A0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • Failed to calculate working folder to ensure it exists., xrefs: 0046A0D8
                                                            • Failed to copy working folder., xrefs: 0046A116
                                                            • Failed create working folder., xrefs: 0046A0EE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentDirectoryErrorLastProcessWindows
                                                            • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                            • API String ID: 3841436932-2072961686
                                                            • Opcode ID: c59ea8fa26cde77fc755ea034230ed8db270d8fc9c6b18290493533352bf793d
                                                            • Instruction ID: 4cfc229989d770c64c1d565e818cc4fc07887fcab18d93f9e07d6c99322dada4
                                                            • Opcode Fuzzy Hash: c59ea8fa26cde77fc755ea034230ed8db270d8fc9c6b18290493533352bf793d
                                                            • Instruction Fuzzy Hash: 80012D32800924F64F226B45DC06DDFBF78DF51710B20416BF80076211EB398E50AA8F
                                                            Function 004848D8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000000,?,004848AE,00000000,004B7F08,0000000C,00484A05,00000000,00000002,00000000), ref: 004848F9
                                                            • TerminateProcess.KERNEL32(00000000,?,004848AE,00000000,004B7F08,0000000C,00484A05,00000000,00000002,00000000), ref: 00484900
                                                            • ExitProcess.KERNEL32 ref: 00484912
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Process$CurrentExitTerminate
                                                            • String ID:
                                                            • API String ID: 1703294689-0
                                                            • Opcode ID: e61997ad19ec88caf206de7bc08aa7534a8bef59afeeae210f80198f1e697850
                                                            • Instruction ID: b9df20da6478e48c8652f745aedecbf12bd90a3bf62abaf7cc1acd076a811469
                                                            • Opcode Fuzzy Hash: e61997ad19ec88caf206de7bc08aa7534a8bef59afeeae210f80198f1e697850
                                                            • Instruction Fuzzy Hash: 47E04F71000108ABCF21BF61DE0994E3B29EF90385B004426F80546122CB39DC42CB88
                                                            Function 0045394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                            • RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID:
                                                            • API String ID: 1357844191-0
                                                            • Opcode ID: 464be4730fd07375e6526f1d694cf81a208c5275a283251e5e759232da748623
                                                            • Instruction ID: eda11244cfc413b132d0a5986a7537b36f6fdbfbfc4eb9ea73dd2e3112c8c7d3
                                                            • Opcode Fuzzy Hash: 464be4730fd07375e6526f1d694cf81a208c5275a283251e5e759232da748623
                                                            • Instruction Fuzzy Hash: 8CC012321A420CAB8B006FF8EC0EC9A3BACFB28A427048422B905C2120C738E4108BA4
                                                            Function 0045F9E3 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 446COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 0 45f9e3-45fa14 call 4939af 3 45fa16 0->3 4 45fa18-45fa1a 0->4 3->4 5 45fa1c-45fa29 call 490237 4->5 6 45fa2e-45fa47 call 4932f3 4->6 11 45ff16-45ff1b 5->11 12 45fa53-45fa68 call 4932f3 6->12 13 45fa49-45fa4e 6->13 14 45ff23-45ff28 11->14 15 45ff1d-45ff1f 11->15 24 45fa74-45fa81 call 45ea42 12->24 25 45fa6a-45fa6f 12->25 16 45ff0d-45ff14 call 490237 13->16 18 45ff30-45ff35 14->18 19 45ff2a-45ff2c 14->19 15->14 30 45ff15 16->30 22 45ff37-45ff39 18->22 23 45ff3d-45ff41 18->23 19->18 22->23 27 45ff43-45ff46 call 495636 23->27 28 45ff4b-45ff52 23->28 33 45fa83-45fa88 24->33 34 45fa8d-45faa2 call 4932f3 24->34 25->16 27->28 30->11 33->16 37 45faa4-45faa9 34->37 38 45faae-45fac0 call 494c97 34->38 37->16 41 45fac2-45faca 38->41 42 45facf-45fae4 call 4932f3 38->42 43 45fd99-45fda2 call 490237 41->43 47 45fae6-45faeb 42->47 48 45faf0-45fb05 call 4932f3 42->48 43->30 47->16 52 45fb07-45fb0c 48->52 53 45fb11-45fb23 call 493505 48->53 52->16 56 45fb25-45fb2a 53->56 57 45fb2f-45fb45 call 4939af 53->57 56->16 60 45fdf4-45fe0e call 45ecbe 57->60 61 45fb4b-45fb4d 57->61 68 45fe10-45fe15 60->68 69 45fe1a-45fe32 call 4939af 60->69 62 45fb4f-45fb54 61->62 63 45fb59-45fb6e call 493505 61->63 62->16 70 45fb70-45fb75 63->70 71 45fb7a-45fb8f call 4932f3 63->71 68->16 75 45fefc-45fefd call 45f0f8 69->75 76 45fe38-45fe3a 69->76 70->16 78 45fb91-45fb93 71->78 79 45fb9f-45fbb4 call 4932f3 71->79 86 45ff02-45ff06 75->86 80 45fe46-45fe64 call 4932f3 76->80 81 45fe3c-45fe41 76->81 78->79 83 45fb95-45fb9a 78->83 90 45fbc4-45fbd9 call 4932f3 79->90 91 45fbb6-45fbb8 79->91 92 45fe66-45fe6b 80->92 93 45fe70-45fe88 call 4932f3 80->93 81->16 83->16 86->30 89 45ff08 86->89 89->16 101 45fbe9-45fbfe call 4932f3 90->101 102 45fbdb-45fbdd 90->102 91->90 94 45fbba-45fbbf 91->94 92->16 99 45fe95-45fead call 4932f3 93->99 100 45fe8a-45fe8c 93->100 94->16 109 45feaf-45feb1 99->109 110 45feba-45fed2 call 4932f3 99->110 100->99 103 45fe8e-45fe93 100->103 111 45fc00-45fc02 101->111 112 45fc0e-45fc23 call 4932f3 101->112 102->101 104 45fbdf-45fbe4 102->104 103->16 104->16 109->110 116 45feb3-45feb8 109->116 119 45fed4-45fed9 110->119 120 45fedb-45fef3 call 4932f3 110->120 111->112 113 45fc04-45fc09 111->113 121 45fc25-45fc27 112->121 122 45fc33-45fc48 call 4932f3 112->122 113->16 116->16 119->16 120->75 128 45fef5-45fefa 120->128 121->122 124 45fc29-45fc2e 121->124 129 45fc58-45fc6d call 4932f3 122->129 130 45fc4a-45fc4c 122->130 124->16 128->16 134 45fc7d-45fc92 call 4932f3 129->134 135 45fc6f-45fc71 129->135 130->129 131 45fc4e-45fc53 130->131 131->16 139 45fc94-45fc96 134->139 140 45fca2-45fcba call 4932f3 134->140 135->134 137 45fc73-45fc78 135->137 137->16 139->140 141 45fc98-45fc9d 139->141 144 45fcbc-45fcbe 140->144 145 45fcca-45fce2 call 4932f3 140->145 141->16 144->145 146 45fcc0-45fcc5 144->146 149 45fce4-45fce6 145->149 150 45fcf2-45fd07 call 4932f3 145->150 146->16 149->150 152 45fce8-45fced 149->152 154 45fda7-45fda9 150->154 155 45fd0d-45fd2a CompareStringW 150->155 152->16 156 45fdb4-45fdb6 154->156 157 45fdab-45fdb2 154->157 158 45fd34-45fd49 CompareStringW 155->158 159 45fd2c-45fd32 155->159 160 45fdc2-45fdda call 493505 156->160 161 45fdb8-45fdbd 156->161 157->156 163 45fd57-45fd6c CompareStringW 158->163 164 45fd4b-45fd55 158->164 162 45fd75-45fd7a 159->162 160->60 170 45fddc-45fdde 160->170 161->16 162->156 166 45fd7c-45fd94 call 453821 163->166 167 45fd6e 163->167 164->162 166->43 167->162 172 45fde0-45fde5 170->172 173 45fdea 170->173 172->16 173->60
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: StringVariant$AllocClearFreeInit
                                                            • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ETE$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$clbcatq.dll$msasn1.dll$registration.cpp$yes
                                                            • API String ID: 760788290-2033306988
                                                            • Opcode ID: 77b743587bb18ccb404c4a657054452cdbd6722b5083504d84a35beac6cef2a0
                                                            • Instruction ID: e27447734a50508c57c00f098c57f35fc435b8d0e6087b50cf4ee4e8d5e84bc4
                                                            • Opcode Fuzzy Hash: 77b743587bb18ccb404c4a657054452cdbd6722b5083504d84a35beac6cef2a0
                                                            • Instruction Fuzzy Hash: 94E12B32E44625BACF119A60CC42FAE76646B16712F210277FD11F7652D76C9D0C93CE
                                                            Function 0045B48B Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 578fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 174 45b48b-45b500 call 47f8e0 * 2 179 45b502-45b50c GetLastError 174->179 180 45b538-45b53e 174->180 181 45b50e-45b517 179->181 182 45b519 179->182 183 45b540 180->183 184 45b542-45b554 SetFilePointerEx 180->184 181->182 185 45b520-45b52d call 453821 182->185 186 45b51b 182->186 183->184 187 45b556-45b560 GetLastError 184->187 188 45b588-45b5a2 ReadFile 184->188 203 45b532-45b533 185->203 186->185 192 45b562-45b56b 187->192 193 45b56d 187->193 189 45b5a4-45b5ae GetLastError 188->189 190 45b5d9-45b5e0 188->190 194 45b5b0-45b5b9 189->194 195 45b5bb 189->195 197 45bbd7-45bbeb call 453821 190->197 198 45b5e6-45b5ef 190->198 192->193 199 45b574-45b586 call 453821 193->199 200 45b56f 193->200 194->195 201 45b5c2-45b5d4 call 453821 195->201 202 45b5bd 195->202 216 45bbf0 197->216 198->197 205 45b5f5-45b605 SetFilePointerEx 198->205 199->203 200->199 201->203 202->201 209 45bbf1-45bbf7 call 490237 203->209 211 45b607-45b611 GetLastError 205->211 212 45b63c-45b654 ReadFile 205->212 231 45bbf8-45bc0a call 47e06f 209->231 218 45b613-45b61c 211->218 219 45b61e 211->219 213 45b656-45b660 GetLastError 212->213 214 45b68b-45b692 212->214 220 45b662-45b66b 213->220 221 45b66d 213->221 223 45bbbc-45bbd5 call 453821 214->223 224 45b698-45b6a2 214->224 216->209 218->219 225 45b625-45b632 call 453821 219->225 226 45b620 219->226 220->221 229 45b674-45b681 call 453821 221->229 230 45b66f 221->230 223->216 224->223 232 45b6a8-45b6cb SetFilePointerEx 224->232 225->212 226->225 229->214 230->229 233 45b702-45b71a ReadFile 232->233 234 45b6cd-45b6d7 GetLastError 232->234 242 45b751-45b769 ReadFile 233->242 243 45b71c-45b726 GetLastError 233->243 240 45b6e4 234->240 241 45b6d9-45b6e2 234->241 247 45b6e6 240->247 248 45b6eb-45b6f8 call 453821 240->248 241->240 245 45b7a0-45b7bb SetFilePointerEx 242->245 246 45b76b-45b775 GetLastError 242->246 249 45b733 243->249 250 45b728-45b731 243->250 254 45b7f5-45b814 ReadFile 245->254 255 45b7bd-45b7c7 GetLastError 245->255 251 45b777-45b780 246->251 252 45b782 246->252 247->248 248->233 256 45b735 249->256 257 45b73a-45b747 call 453821 249->257 250->249 251->252 260 45b784 252->260 261 45b789-45b796 call 453821 252->261 258 45bb7d-45bb87 GetLastError 254->258 259 45b81a-45b81c 254->259 263 45b7d4 255->263 264 45b7c9-45b7d2 255->264 256->257 257->242 268 45bb94 258->268 269 45bb89-45bb92 258->269 266 45b81d-45b824 259->266 260->261 261->245 270 45b7d6 263->270 271 45b7db-45b7eb call 453821 263->271 264->263 274 45bb58-45bb75 call 453821 266->274 275 45b82a-45b836 266->275 277 45bb96 268->277 278 45bb9b-45bbb1 call 453821 268->278 269->268 270->271 271->254 290 45bb7a-45bb7b 274->290 281 45b841-45b84a 275->281 282 45b838-45b83f 275->282 277->278 289 45bbb2-45bbba call 490237 278->289 287 45b850-45b876 ReadFile 281->287 288 45bb1b-45bb32 call 453821 281->288 282->281 286 45b884-45b88b 282->286 292 45b8b4-45b8cb call 45394f 286->292 293 45b88d-45b8af call 453821 286->293 287->258 291 45b87c-45b882 287->291 302 45bb37-45bb3d call 490237 288->302 289->231 290->289 291->266 303 45b8cd-45b8ea call 453821 292->303 304 45b8ef-45b904 SetFilePointerEx 292->304 293->290 310 45bb43-45bb44 302->310 303->209 308 45b944-45b969 ReadFile 304->308 309 45b906-45b910 GetLastError 304->309 311 45b9a0-45b9ac 308->311 312 45b96b-45b975 GetLastError 308->312 314 45b912-45b91b 309->314 315 45b91d 309->315 316 45bb45-45bb47 310->316 319 45b9cf-45b9d3 311->319 320 45b9ae-45b9ca call 453821 311->320 317 45b977-45b980 312->317 318 45b982 312->318 314->315 321 45b924-45b934 call 453821 315->321 322 45b91f 315->322 316->231 323 45bb4d-45bb53 call 453a16 316->323 317->318 324 45b984 318->324 325 45b989-45b99e call 453821 318->325 328 45b9d5-45ba09 call 453821 call 490237 319->328 329 45ba0e-45ba21 call 494a05 319->329 320->302 339 45b939-45b93f call 490237 321->339 322->321 323->231 324->325 325->339 328->316 342 45ba23-45ba28 329->342 343 45ba2d-45ba37 329->343 339->310 342->339 346 45ba41-45ba49 343->346 347 45ba39-45ba3f 343->347 350 45ba55-45ba58 346->350 351 45ba4b-45ba53 346->351 349 45ba5a-45baba call 45394f 347->349 354 45babc-45bad8 call 453821 349->354 355 45bade-45baff call 47f360 call 45b208 349->355 350->349 351->349 354->355 355->316 362 45bb01-45bb11 call 453821 355->362 362->288
                                                            APIs
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 0045B502
                                                            • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B550
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 0045B556
                                                            • ReadFile.KERNELBASE(00000000,aDEH,00000040,?,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B59E
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 0045B5A4
                                                            • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B601
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B607
                                                            • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B650
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B656
                                                            • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B6C7
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B6CD
                                                            • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B716
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B71C
                                                            • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B765
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B76B
                                                            • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B7B7
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B7BD
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B810
                                                            • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B872
                                                            • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B8FC
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B906
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                            • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$aDEH$burn$section.cpp
                                                            • API String ID: 3411815225-182475682
                                                            • Opcode ID: a5ba28e2d095c5c4a0a9e7bcf2e032f6def07391de787f2c3cfe4c181c0db7ac
                                                            • Instruction ID: 24ec1d87e82ef845f4286f4b37a69b5d7029b4fd23dfba6edbec44e29027a9a5
                                                            • Opcode Fuzzy Hash: a5ba28e2d095c5c4a0a9e7bcf2e032f6def07391de787f2c3cfe4c181c0db7ac
                                                            • Instruction Fuzzy Hash: 1D120772940235ABDF30DA568C45FAB7AA4EB04712F1141BBFD04AB282E7789D448BDD
                                                            Function 00470D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 365 470d16-470d2d SetEvent 366 470d6f-470d7d WaitForSingleObject 365->366 367 470d2f-470d39 GetLastError 365->367 368 470db4-470dbf ResetEvent 366->368 369 470d7f-470d89 GetLastError 366->369 370 470d46 367->370 371 470d3b-470d44 367->371 374 470dc1-470dcb GetLastError 368->374 375 470df9-470dff 368->375 372 470d96 369->372 373 470d8b-470d94 369->373 376 470d4d-470d5d call 453821 370->376 377 470d48 370->377 371->370 380 470d9d-470db2 call 453821 372->380 381 470d98 372->381 373->372 382 470dcd-470dd6 374->382 383 470dd8 374->383 378 470e32-470e4b call 4521ac 375->378 379 470e01-470e04 375->379 397 470d62-470d6a call 490237 376->397 377->376 401 470e63-470e6e SetEvent 378->401 402 470e4d-470e5e call 490237 378->402 385 470e06-470e23 call 453821 379->385 386 470e28-470e2d 379->386 380->397 381->380 382->383 389 470ddf-470df4 call 453821 383->389 390 470dda 383->390 406 4710de-4710e4 call 490237 385->406 394 4710e8-4710ed 386->394 389->397 390->389 403 4710f2-4710f8 394->403 404 4710ef 394->404 397->394 408 470e70-470e7a GetLastError 401->408 409 470ea8-470eb6 WaitForSingleObject 401->409 421 4710e5-4710e7 402->421 404->403 406->421 410 470e87 408->410 411 470e7c-470e85 408->411 412 470ef0-470efb ResetEvent 409->412 413 470eb8-470ec2 GetLastError 409->413 416 470e8e-470ea3 call 453821 410->416 417 470e89 410->417 411->410 422 470f35-470f3c 412->422 423 470efd-470f07 GetLastError 412->423 418 470ec4-470ecd 413->418 419 470ecf 413->419 440 4710dd 416->440 417->416 418->419 429 470ed6-470eeb call 453821 419->429 430 470ed1 419->430 421->394 427 470f3e-470f41 422->427 428 470fab-470fce CreateFileW 422->428 424 470f14 423->424 425 470f09-470f12 423->425 431 470f16 424->431 432 470f1b-470f30 call 453821 424->432 425->424 436 470f43-470f46 427->436 437 470f6e-470f72 call 45394f 427->437 434 470fd0-470fda GetLastError 428->434 435 47100b-47101f SetFilePointerEx 428->435 429->440 430->429 431->432 432->440 441 470fe7 434->441 442 470fdc-470fe5 434->442 446 471021-47102b GetLastError 435->446 447 471059-471064 SetEndOfFile 435->447 443 470f67-470f69 436->443 444 470f48-470f4b 436->444 451 470f77-470f7c 437->451 440->406 455 470fee-471001 call 453821 441->455 456 470fe9 441->456 442->441 443->394 457 470f5d-470f62 444->457 458 470f4d-470f53 444->458 449 47102d-471036 446->449 450 471038 446->450 453 471066-471070 GetLastError 447->453 454 47109b-4710a8 SetFilePointerEx 447->454 449->450 461 47103f-471054 call 453821 450->461 462 47103a 450->462 459 470f7e-470f98 call 453821 451->459 460 470f9d-470fa6 451->460 463 471072-47107b 453->463 464 47107d 453->464 454->421 466 4710aa-4710b4 GetLastError 454->466 455->435 456->455 457->421 458->457 459->440 460->421 461->440 462->461 463->464 471 471084-471099 call 453821 464->471 472 47107f 464->472 467 4710b6-4710bf 466->467 468 4710c1 466->468 467->468 474 4710c3 468->474 475 4710c8-4710d8 call 453821 468->475 471->440 472->471 474->475 475->440
                                                            APIs
                                                            • SetEvent.KERNEL32(?,?,?,?,?,004708BC,?,?), ref: 00470D25
                                                            • GetLastError.KERNEL32(?,?,?,?,004708BC,?,?), ref: 00470D2F
                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,004708BC,?,?), ref: 00470D74
                                                            • GetLastError.KERNEL32(?,?,?,?,004708BC,?,?), ref: 00470D7F
                                                            • ResetEvent.KERNEL32(?,?,?,?,?,004708BC,?,?), ref: 00470DB7
                                                            • GetLastError.KERNEL32(?,?,?,?,004708BC,?,?), ref: 00470DC1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                            • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 1865021742-2104912459
                                                            • Opcode ID: 0bfd6d46d39619d43bc2c4a8541bffa521a94aeb94a880b34369af184c9a09a0
                                                            • Instruction ID: 21a82f83b61beed319d24e8a13de2e2b3e06dd42910f972720cf3787a9da209f
                                                            • Opcode Fuzzy Hash: 0bfd6d46d39619d43bc2c4a8541bffa521a94aeb94a880b34369af184c9a09a0
                                                            • Instruction Fuzzy Hash: 5A912A33982672B7D73016A94E09BAB2954EB11B61F21C637FE18BA6D0D35CEC10C1DE
                                                            Function 00454D39 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 220COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 848 454d39-454d81 call 47f8e0 call 4533c7 853 454d95-454d9f call 4698f7 848->853 854 454d83-454d90 call 490237 848->854 860 454da1-454da6 853->860 861 454da8-454db7 call 4698fd 853->861 859 454f31-454f3b 854->859 862 454f46-454f4a 859->862 863 454f3d-454f42 CloseHandle 859->863 864 454ddd-454df8 call 451f13 860->864 869 454dbc-454dc0 861->869 867 454f55-454f59 862->867 868 454f4c-454f51 CloseHandle 862->868 863->862 875 454e01-454e15 call 466a57 864->875 876 454dfa-454dff 864->876 871 454f64-454f66 867->871 872 454f5b-454f60 CloseHandle 867->872 868->867 873 454dd7-454dda 869->873 874 454dc2 869->874 878 454f68-454f69 CloseHandle 871->878 879 454f6b-454f7f call 452782 * 2 871->879 872->871 873->864 877 454dc7-454dd2 call 490237 874->877 887 454e17 875->887 888 454e2f-454e43 call 466b13 875->888 876->877 877->859 878->879 892 454f81-454f84 call 495636 879->892 893 454f89-454f8d 879->893 890 454e1c 887->890 900 454e45-454e4a 888->900 901 454e4c-454e67 call 451f55 888->901 894 454e21-454e2a call 490237 890->894 892->893 897 454f97-454f9f 893->897 898 454f8f-454f92 call 495636 893->898 906 454f2e 894->906 898->897 900->890 907 454e73-454e8c call 451f55 901->907 908 454e69-454e6e 901->908 906->859 911 454e8e-454e93 907->911 912 454e98-454ec4 CreateProcessW 907->912 908->877 911->877 913 454ec6-454ed0 GetLastError 912->913 914 454f01-454f17 call 490a28 912->914 916 454ed2-454edb 913->916 917 454edd 913->917 918 454f1c-454f20 914->918 916->917 919 454ee4-454efc call 453821 917->919 920 454edf 917->920 918->859 921 454f22-454f29 call 490237 918->921 919->894 920->919 921->906
                                                            APIs
                                                              • Part of subcall function 004533C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004510DD,?,00000000), ref: 004533E8
                                                            • CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00454F40
                                                            • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00454F4F
                                                            • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00454F5E
                                                            • CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00454F69
                                                            Strings
                                                            • burn.filehandle.attached, xrefs: 00454E17
                                                            • burn.filehandle.self, xrefs: 00454E45
                                                            • D, xrefs: 00454EA9
                                                            • -%ls="%ls", xrefs: 00454DE6
                                                            • Failed to wait for clean room process: %ls, xrefs: 00454F23
                                                            • Failed to allocate full command-line., xrefs: 00454E8E
                                                            • burn.clean.room, xrefs: 00454DDE
                                                            • Failed to launch clean room process: %ls, xrefs: 00454EF7
                                                            • Failed to allocate parameters for unelevated process., xrefs: 00454DFA
                                                            • "%ls" %ls, xrefs: 00454E7A
                                                            • Failed to append %ls, xrefs: 00454E1C
                                                            • engine.cpp, xrefs: 00454EEA
                                                            • Failed to get path for current process., xrefs: 00454D83
                                                            • Failed to cache to clean room., xrefs: 00454DC2
                                                            • Failed to append original command line., xrefs: 00454E69
                                                            • %ls %ls, xrefs: 00454E55
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$FileModuleName
                                                            • String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                            • API String ID: 3884789274-2391192076
                                                            • Opcode ID: 9231cc0f2ade466ca1431f51dc7291537cbcb70864d6a7d61eed4ba84fa019a6
                                                            • Instruction ID: a5240db14c6ff4323f0a03b360e068079b50648c93582f87dd129930a43f19c0
                                                            • Opcode Fuzzy Hash: 9231cc0f2ade466ca1431f51dc7291537cbcb70864d6a7d61eed4ba84fa019a6
                                                            • Instruction Fuzzy Hash: 3771C232D00229AACF119A95CD41EEFBB78EF44725F100127FD10BB292D7789A498BD9
                                                            Function 0046752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 925 46752a-46756f call 47f8e0 call 45762c 930 467571-467576 925->930 931 46757b-46758c call 45c407 925->931 932 467814-46781b call 490237 930->932 937 46758e-467593 931->937 938 467598-4675a9 call 45c26e 931->938 939 46781c-467821 932->939 937->932 947 4675b5-4675ca call 45c4c8 938->947 948 4675ab-4675b0 938->948 941 467823-467824 call 495636 939->941 942 467829-46782d 939->942 941->942 945 467837-46783c 942->945 946 46782f-467832 call 495636 942->946 951 467844-467851 call 45c1bb 945->951 952 46783e-46783f call 495636 945->952 946->945 956 4675d6-4675e6 call 47c001 947->956 957 4675cc-4675d1 947->957 948->932 959 467853-467856 call 495636 951->959 960 46785b-46785f 951->960 952->951 966 4675f2-467665 call 465c33 956->966 967 4675e8-4675ed 956->967 957->932 959->960 964 467861-467864 call 495636 960->964 965 467869-46786d 960->965 964->965 969 467877-46787f 965->969 970 46786f-467872 call 453a16 965->970 974 467667-46766c 966->974 975 467671-467676 966->975 967->932 970->969 974->932 976 46767d-467698 call 455602 GetCurrentProcess call 490879 975->976 977 467678 975->977 981 46769d-4676b4 call 45827b 976->981 977->976 984 4676b6 981->984 985 4676ce-4676e5 call 45827b 981->985 986 4676bb-4676c9 call 490237 984->986 991 4676e7-4676ec 985->991 992 4676ee-4676f3 985->992 986->939 991->986 993 4676f5-467707 call 45821f 992->993 994 46774f-467754 992->994 1003 467713-467723 call 453436 993->1003 1004 467709-46770e 993->1004 995 467756-467768 call 45821f 994->995 996 467774-46777d 994->996 995->996 1010 46776a-46776f 995->1010 998 46777f-467782 996->998 999 467789-46779d call 46a50c 996->999 998->999 1002 467784-467787 998->1002 1012 4677a6 999->1012 1013 46779f-4677a4 999->1013 1002->999 1007 4677ac-4677af 1002->1007 1016 467725-46772a 1003->1016 1017 46772f-467743 call 45821f 1003->1017 1004->932 1014 4677b6-4677cc call 45d5a0 1007->1014 1015 4677b1-4677b4 1007->1015 1010->932 1012->1007 1013->932 1022 4677d5-4677ed call 45cbc5 1014->1022 1023 4677ce-4677d3 1014->1023 1015->939 1015->1014 1016->932 1017->994 1024 467745-46774a 1017->1024 1027 4677f6-46780d call 45c8e6 1022->1027 1028 4677ef-4677f4 1022->1028 1023->932 1024->932 1027->939 1031 46780f 1027->1031 1028->932 1031->932
                                                            Strings
                                                            • Failed to get source process folder from path., xrefs: 00467725
                                                            • Failed to open attached UX container., xrefs: 0046758E
                                                            • WixBundleOriginalSource, xrefs: 00467759
                                                            • Failed to open manifest stream., xrefs: 004675AB
                                                            • Failed to parse command line., xrefs: 00467667
                                                            • Failed to set source process folder variable., xrefs: 00467745
                                                            • Failed to initialize internal cache functionality., xrefs: 0046779F
                                                            • Failed to load manifest., xrefs: 004675E8
                                                            • WixBundleSourceProcessPath, xrefs: 004676F8
                                                            • Failed to set original source variable., xrefs: 0046776A
                                                            • Failed to get unique temporary folder for bootstrapper application., xrefs: 004677CE
                                                            • Failed to overwrite the %ls built-in variable., xrefs: 004676BB
                                                            • WixBundleUILevel, xrefs: 004676D6, 004676E7
                                                            • Failed to extract bootstrapper application payloads., xrefs: 004677EF
                                                            • Failed to load catalog files., xrefs: 0046780F
                                                            • WixBundleElevated, xrefs: 004676A5, 004676B6
                                                            • Failed to set source process path variable., xrefs: 00467709
                                                            • Failed to get manifest stream from container., xrefs: 004675CC
                                                            • Failed to initialize variables., xrefs: 00467571
                                                            • WixBundleSourceProcessFolder, xrefs: 00467734
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalInitializeSection
                                                            • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                            • API String ID: 32694325-1564579409
                                                            • Opcode ID: ce1ecbad905ebc3c36070c8169f9ce4cd53709ce1bc50a5a1ad07618a3e7996f
                                                            • Instruction ID: bc145d3e29546f25ee90999be60332d8d86f5ed3cae44824cb11312ecec6a0f0
                                                            • Opcode Fuzzy Hash: ce1ecbad905ebc3c36070c8169f9ce4cd53709ce1bc50a5a1ad07618a3e7996f
                                                            • Instruction Fuzzy Hash: BCA1D772E44616BACB129AA0CC85FEFB76CBB00748F100267F515F7141E778AD04CBAA
                                                            Function 004686D0 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 209fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1032 4686d0-46871e CreateFileW 1033 468764-468774 call 49490d 1032->1033 1034 468720-46872a GetLastError 1032->1034 1041 468776-468787 call 490237 1033->1041 1042 46878c-468797 call 493edd 1033->1042 1035 468737 1034->1035 1036 46872c-468735 1034->1036 1038 46873e-46875f call 453821 call 490237 1035->1038 1039 468739 1035->1039 1036->1035 1054 468908-46891a call 47e06f 1038->1054 1039->1038 1050 468901-468902 CloseHandle 1041->1050 1048 46879c-4687a0 1042->1048 1051 4687a2-4687b6 call 490237 1048->1051 1052 4687bb-4687c0 1048->1052 1050->1054 1051->1050 1052->1050 1056 4687c6-4687d5 SetFilePointerEx 1052->1056 1059 4687d7-4687e1 GetLastError 1056->1059 1060 46880f-46881f call 494e3a 1056->1060 1063 4687e3-4687ec 1059->1063 1064 4687ee 1059->1064 1069 468821-468826 1060->1069 1070 46882b-46883c SetFilePointerEx 1060->1070 1063->1064 1066 4687f5-46880a call 453821 1064->1066 1067 4687f0 1064->1067 1072 4688f9-468900 call 490237 1066->1072 1067->1066 1069->1072 1073 468876-468886 call 494e3a 1070->1073 1074 46883e-468848 GetLastError 1070->1074 1072->1050 1073->1069 1083 468888-468898 call 494e3a 1073->1083 1076 468855 1074->1076 1077 46884a-468853 1074->1077 1081 468857 1076->1081 1082 46885c-468871 call 453821 1076->1082 1077->1076 1081->1082 1082->1072 1083->1069 1088 46889a-4688ab SetFilePointerEx 1083->1088 1089 4688e2-4688f2 call 494e3a 1088->1089 1090 4688ad-4688b7 GetLastError 1088->1090 1089->1050 1098 4688f4 1089->1098 1091 4688c4 1090->1091 1092 4688b9-4688c2 1090->1092 1094 4688c6 1091->1094 1095 4688cb-4688e0 call 453821 1091->1095 1092->1091 1094->1095 1095->1072 1098->1072
                                                            APIs
                                                            • CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00454DBC,?,?,00000000,00454DBC,00000000), ref: 00468713
                                                            • GetLastError.KERNEL32 ref: 00468720
                                                              • Part of subcall function 00493EDD: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00493F73
                                                            • SetFilePointerEx.KERNEL32(00000000,0049B4B8,00000000,00000000,00000000,?,00000000,0049B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004687CD
                                                            • GetLastError.KERNEL32 ref: 004687D7
                                                            • CloseHandle.KERNELBASE(00000000,?,00000000,0049B500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00468902
                                                            Strings
                                                            • msi.dll, xrefs: 00468814
                                                            • Failed to copy engine from: %ls to: %ls, xrefs: 004687A8
                                                            • Failed to seek to signature table in exe header., xrefs: 0046886C
                                                            • Failed to seek to original data in exe burn section header., xrefs: 004688DB
                                                            • cabinet.dll, xrefs: 0046887B
                                                            • Failed to seek to checksum in exe header., xrefs: 00468805
                                                            • Failed to seek to beginning of engine file: %ls, xrefs: 00468779
                                                            • cache.cpp, xrefs: 00468744, 004687FB, 00468862, 004688D1
                                                            • Failed to create engine file at path: %ls, xrefs: 00468751
                                                            • Failed to update signature offset., xrefs: 00468821
                                                            • Failed to zero out original data offset., xrefs: 004688F4
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorLast$CloseCreateHandlePointerRead
                                                            • String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
                                                            • API String ID: 3456208997-1976062716
                                                            • Opcode ID: d7cf985afd78e3e523e2bb2034b46e791692d41f55cca2131d206a4890337191
                                                            • Instruction ID: d6f207567e328b63882333cbc660a9ceb6e5ccc9ce1ed44bbca472a7357362ed
                                                            • Opcode Fuzzy Hash: d7cf985afd78e3e523e2bb2034b46e791692d41f55cca2131d206a4890337191
                                                            • Instruction Fuzzy Hash: 3251A872A41535ABEB216B558C46F7F3A58EB15B50F11027FFE00B7241FA199C0186EF
                                                            Function 0045762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1100 45762c-457edf InitializeCriticalSection 1101 457ee2-457f06 call 455623 1100->1101 1104 457f13-457f24 call 490237 1101->1104 1105 457f08-457f0f 1101->1105 1108 457f27-457f39 call 47e06f 1104->1108 1105->1101 1106 457f11 1105->1106 1106->1108
                                                            APIs
                                                            • InitializeCriticalSection.KERNEL32(0046756B,004553BD,00000000,00455445), ref: 0045764C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalInitializeSection
                                                            • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                            • API String ID: 32694325-3635313340
                                                            • Opcode ID: 723b226f06aa224c670acc3ebcea235d1d63a34cde99cbdd3222ddfbacfb9b29
                                                            • Instruction ID: 476fcafc7871836787d8c132fe0fd7a31eede30a803491abda1962d8cf30f27e
                                                            • Opcode Fuzzy Hash: 723b226f06aa224c670acc3ebcea235d1d63a34cde99cbdd3222ddfbacfb9b29
                                                            • Instruction Fuzzy Hash: 253258B0D116299FDB65CF5AC9887DDFAB4BB48304F9081EED60CA7211C7B40B888F49
                                                            Function 004682BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1112 4682ba-468303 call 47f8e0 1115 46847c-468489 call 452195 1112->1115 1116 468309-468317 GetCurrentProcess call 490879 1112->1116 1121 46848b 1115->1121 1122 468498-4684aa call 47e06f 1115->1122 1119 46831c-468329 1116->1119 1123 4683b7-4683c5 1119->1123 1124 46832f-46833e GetWindowsDirectoryW 1119->1124 1125 468490-468497 call 490237 1121->1125 1137 4683c7-4683d1 GetLastError 1123->1137 1138 4683ff-468411 UuidCreate 1123->1138 1127 468340-46834a GetLastError 1124->1127 1128 468378-468389 call 45337f 1124->1128 1125->1122 1133 468357 1127->1133 1134 46834c-468355 1127->1134 1141 468395-4683ab call 4536a3 1128->1141 1142 46838b-468390 1128->1142 1139 46835e-468373 call 453821 1133->1139 1140 468359 1133->1140 1134->1133 1145 4683d3-4683dc 1137->1145 1146 4683de 1137->1146 1143 468413-468418 1138->1143 1144 46841a-46842f StringFromGUID2 1138->1144 1139->1125 1140->1139 1141->1138 1159 4683ad-4683b2 1141->1159 1142->1125 1143->1125 1149 468431-46844b call 453821 1144->1149 1150 46844d-46846e call 451f13 1144->1150 1145->1146 1151 4683e5-4683fa call 453821 1146->1151 1152 4683e0 1146->1152 1149->1125 1162 468477 1150->1162 1163 468470-468475 1150->1163 1151->1125 1152->1151 1159->1125 1162->1115 1163->1125
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00455489), ref: 00468310
                                                              • Part of subcall function 00490879: OpenProcessToken.ADVAPI32(?,00000008,?,004553BD,00000000,?,?,?,?,?,?,?,0046769D,00000000), ref: 00490897
                                                              • Part of subcall function 00490879: GetLastError.KERNEL32(?,?,?,?,?,?,?,0046769D,00000000), ref: 004908A1
                                                              • Part of subcall function 00490879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0046769D,00000000), ref: 0049092B
                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00468336
                                                            • GetLastError.KERNEL32 ref: 00468340
                                                            • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 004683BD
                                                            • GetLastError.KERNEL32 ref: 004683C7
                                                            • UuidCreate.RPCRT4(?), ref: 00468406
                                                            Strings
                                                            • Failed to get windows path for working folder., xrefs: 0046836E
                                                            • Failed to concat Temp directory on windows path for working folder., xrefs: 004683AD
                                                            • Failed to convert working folder guid into string., xrefs: 00468446
                                                            • Failed to copy working folder path., xrefs: 0046848B
                                                            • %ls%ls\, xrefs: 00468458
                                                            • 4Mw, xrefs: 004683BD
                                                            • Failed to append bundle id on to temp path for working folder., xrefs: 00468470
                                                            • Failed to ensure windows path for working folder ended in backslash., xrefs: 0046838B
                                                            • Failed to create working folder guid., xrefs: 00468413
                                                            • Temp\, xrefs: 00468395
                                                            • cache.cpp, xrefs: 00468364, 004683EB, 0046843C
                                                            • Failed to get temp path for working folder., xrefs: 004683F5
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                            • String ID: 4Mw$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                            • API String ID: 266130487-1835725942
                                                            • Opcode ID: 497d473225369bcee79ff6dc28102d16f09752221c8b02946067aad1a1dabed8
                                                            • Instruction ID: f285aa6848dc1f0f31c84c8a91ef4e5664b7f886c44cc3451c507ac1b8574802
                                                            • Opcode Fuzzy Hash: 497d473225369bcee79ff6dc28102d16f09752221c8b02946067aad1a1dabed8
                                                            • Instruction Fuzzy Hash: C141F732A40325A7CB30D6A18D09F9B736C9B14B11F15426FBE08E7240FE7C9D4486EE
                                                            Function 004710FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1164 4710fb-471127 CoInitializeEx 1165 47113b-471186 call 48f483 1164->1165 1166 471129-471136 call 490237 1164->1166 1171 4711b0-4711d2 call 48f4a4 1165->1171 1172 471188-4711ab call 453821 call 490237 1165->1172 1173 47139e-4713b0 call 47e06f 1166->1173 1181 47128c-471297 SetEvent 1171->1181 1182 4711d8-4711e0 1171->1182 1190 471397-471398 CoUninitialize 1172->1190 1183 4712d6-4712e4 WaitForSingleObject 1181->1183 1184 471299-4712a3 GetLastError 1181->1184 1186 4711e6-4711ec 1182->1186 1187 47138f-471392 call 48f4b4 1182->1187 1193 4712e6-4712f0 GetLastError 1183->1193 1194 471318-471323 ResetEvent 1183->1194 1188 4712a5-4712ae 1184->1188 1189 4712b0 1184->1189 1186->1187 1192 4711f2-4711fa 1186->1192 1187->1190 1188->1189 1195 4712b4-4712c4 call 453821 1189->1195 1196 4712b2 1189->1196 1190->1173 1199 471274-471287 call 490237 1192->1199 1200 4711fc-4711fe 1192->1200 1201 4712f2-4712fb 1193->1201 1202 4712fd 1193->1202 1197 471325-47132f GetLastError 1194->1197 1198 47135a-471360 1194->1198 1238 4712c9-4712d1 call 490237 1195->1238 1196->1195 1206 471331-47133a 1197->1206 1207 47133c 1197->1207 1211 471362-471365 1198->1211 1212 47138a 1198->1212 1199->1187 1209 471211-471214 1200->1209 1210 471200 1200->1210 1201->1202 1204 471301-471316 call 453821 1202->1204 1205 4712ff 1202->1205 1204->1238 1205->1204 1206->1207 1217 471340-471355 call 453821 1207->1217 1218 47133e 1207->1218 1213 471216 1209->1213 1214 47126e 1209->1214 1220 471206-47120f 1210->1220 1221 471202-471204 1210->1221 1222 471367-471381 call 453821 1211->1222 1223 471386-471388 1211->1223 1212->1187 1225 471247-47124c 1213->1225 1226 471255-47125a 1213->1226 1227 471224-471229 1213->1227 1228 471263-471268 1213->1228 1229 471232-471237 1213->1229 1230 471240-471245 1213->1230 1231 47124e-471253 1213->1231 1232 47121d-471222 1213->1232 1233 47125c-471261 1213->1233 1234 47122b-471230 1213->1234 1235 47126a-47126c 1213->1235 1236 471239-47123e 1213->1236 1240 471270-471272 1214->1240 1217->1238 1218->1217 1220->1240 1221->1240 1222->1238 1223->1187 1225->1199 1226->1199 1227->1199 1228->1199 1229->1199 1230->1199 1231->1199 1232->1199 1233->1199 1234->1199 1235->1199 1236->1199 1238->1187 1240->1181 1240->1199
                                                            APIs
                                                            • CoInitializeEx.COMBASE(00000000,00000000), ref: 0047111D
                                                            • CoUninitialize.COMBASE ref: 00471398
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: InitializeUninitialize
                                                            • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 3442037557-1168358783
                                                            • Opcode ID: a3735993d51db6abc34cc4a64052d9398b0356e414d60de0b9c8b7c5b49cb03d
                                                            • Instruction ID: 52e4dd14371efbbd55e27ebd17431ca7dbc4a909be3b81d7c5c30e5fc794492d
                                                            • Opcode Fuzzy Hash: a3735993d51db6abc34cc4a64052d9398b0356e414d60de0b9c8b7c5b49cb03d
                                                            • Instruction Fuzzy Hash: 5C511936940161E79B20569D8C05EFF26589B15B60B32C3BBBD09BB3B2D61D8C01D1EF
                                                            Function 004542D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1245 4542d7-45432e InitializeCriticalSection * 2 call 464d05 * 2 1250 454334 1245->1250 1251 454452-45445c call 45b48b 1245->1251 1252 45433a-454347 1250->1252 1256 454461-454465 1251->1256 1254 454445-45444c 1252->1254 1255 45434d-454379 lstrlenW * 2 CompareStringW 1252->1255 1254->1251 1254->1252 1257 4543cb-4543f7 lstrlenW * 2 CompareStringW 1255->1257 1258 45437b-45439e lstrlenW 1255->1258 1259 454474-45447c 1256->1259 1260 454467-454473 call 490237 1256->1260 1257->1254 1264 4543f9-45441c lstrlenW 1257->1264 1261 4543a4-4543a9 1258->1261 1262 45448a-45449f call 453821 1258->1262 1260->1259 1261->1262 1265 4543af-4543bf call 4529ce 1261->1265 1274 4544a4-4544ab 1262->1274 1268 4544b6-4544d0 call 453821 1264->1268 1269 454422-454427 1264->1269 1280 4543c5 1265->1280 1281 45447f-454488 1265->1281 1268->1274 1269->1268 1270 45442d-45443d call 4529ce 1269->1270 1270->1281 1283 45443f 1270->1283 1278 4544ac-4544b4 call 490237 1274->1278 1278->1259 1280->1257 1281->1278 1283->1254
                                                            APIs
                                                            • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00455266,?,?,00000000,?,?), ref: 00454303
                                                            • InitializeCriticalSection.KERNEL32(000000D0,?,?,00455266,?,?,00000000,?,?), ref: 0045430C
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00455266,?,?,00000000,?,?), ref: 00454352
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00455266,?,?,00000000,?,?), ref: 0045435C
                                                            • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00455266,?,?,00000000,?,?), ref: 00454370
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00455266,?,?,00000000,?,?), ref: 00454380
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00455266,?,?,00000000,?,?), ref: 004543D0
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00455266,?,?,00000000,?,?), ref: 004543DA
                                                            • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00455266,?,?,00000000,?,?), ref: 004543EE
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00455266,?,?,00000000,?,?), ref: 004543FE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                            • String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                            • API String ID: 3039292287-3209860532
                                                            • Opcode ID: ae3236be89592d93eeff976714df97965aa18a53b05351b6bdf76656ff75fec3
                                                            • Instruction ID: f17ba2b984e8c322359e8b08cf0cd60f545a9374867662802fadab138df2cd0e
                                                            • Opcode Fuzzy Hash: ae3236be89592d93eeff976714df97965aa18a53b05351b6bdf76656ff75fec3
                                                            • Instruction Fuzzy Hash: 3151E471A40215BFCF20EF65DC86F9A7B68EF45765F10012BFA049B291D778A840CAEC
                                                            Function 0045C28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1285 45c28f-45c2c1 1286 45c2c3-45c2e1 CreateFileW 1285->1286 1287 45c32b-45c347 GetCurrentProcess * 2 DuplicateHandle 1285->1287 1290 45c2e7-45c2f1 GetLastError 1286->1290 1291 45c383-45c389 1286->1291 1288 45c381 1287->1288 1289 45c349-45c353 GetLastError 1287->1289 1288->1291 1292 45c355-45c35e 1289->1292 1293 45c360 1289->1293 1294 45c2f3-45c2fc 1290->1294 1295 45c2fe 1290->1295 1296 45c393 1291->1296 1297 45c38b-45c391 1291->1297 1292->1293 1299 45c367-45c37f call 453821 1293->1299 1300 45c362 1293->1300 1294->1295 1301 45c305-45c318 call 453821 1295->1301 1302 45c300 1295->1302 1298 45c395-45c3a3 SetFilePointerEx 1296->1298 1297->1298 1304 45c3a5-45c3af GetLastError 1298->1304 1305 45c3da-45c3e0 1298->1305 1313 45c31d-45c326 call 490237 1299->1313 1300->1299 1301->1313 1302->1301 1308 45c3b1-45c3ba 1304->1308 1309 45c3bc 1304->1309 1310 45c3e2-45c3e6 call 471741 1305->1310 1311 45c3fe-45c404 1305->1311 1308->1309 1314 45c3c3-45c3d8 call 453821 1309->1314 1315 45c3be 1309->1315 1319 45c3eb-45c3ef 1310->1319 1313->1311 1323 45c3f6-45c3fd call 490237 1314->1323 1315->1314 1319->1311 1322 45c3f1 1319->1322 1322->1323 1323->1311
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,0045C47F,00455405,?,?,00455445), ref: 0045C2D6
                                                            • GetLastError.KERNEL32(?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C2E7
                                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,0045C47F,00455405,?,?,00455445,00455445,00000000,?), ref: 0045C336
                                                            • GetCurrentProcess.KERNEL32(000000FF,00000000,?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C33C
                                                            • DuplicateHandle.KERNELBASE(00000000,?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C33F
                                                            • GetLastError.KERNEL32(?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C349
                                                            • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C39B
                                                            • GetLastError.KERNEL32(?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 0045C3A5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                            • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                            • API String ID: 2619879409-373955632
                                                            • Opcode ID: 553179e35046679e35d879b524e76abd90295f3746511eec228f6d67d9c44a5a
                                                            • Instruction ID: 9f9c9dd999f191dfa166e428dcf4f3088b1dd922c19820aa278a2bb51c32ad82
                                                            • Opcode Fuzzy Hash: 553179e35046679e35d879b524e76abd90295f3746511eec228f6d67d9c44a5a
                                                            • Instruction Fuzzy Hash: AF41C636140305AFDB209F5A9D89F1B3AA5EB84761B21803BFD14DB342E779D805DAA8
                                                            Function 00492AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1326 492af7-492b17 call 453838 1329 492b1d-492b2b call 494a6c 1326->1329 1330 492c21-492c25 1326->1330 1334 492b30-492b4f GetProcAddress 1329->1334 1332 492c2f-492c35 1330->1332 1333 492c27-492c2a call 495636 1330->1333 1333->1332 1336 492b51 1334->1336 1337 492b56-492b6f GetProcAddress 1334->1337 1336->1337 1338 492b71 1337->1338 1339 492b76-492b8f GetProcAddress 1337->1339 1338->1339 1340 492b91 1339->1340 1341 492b96-492baf GetProcAddress 1339->1341 1340->1341 1342 492bb1 1341->1342 1343 492bb6-492bcf GetProcAddress 1341->1343 1342->1343 1344 492bd1 1343->1344 1345 492bd6-492bef GetProcAddress 1343->1345 1344->1345 1346 492bf1 1345->1346 1347 492bf6-492c10 GetProcAddress 1345->1347 1346->1347 1348 492c12 1347->1348 1349 492c17 1347->1349 1348->1349 1349->1330
                                                            APIs
                                                              • Part of subcall function 00453838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00453877
                                                              • Part of subcall function 00453838: GetLastError.KERNEL32 ref: 00453881
                                                              • Part of subcall function 00494A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00494A9D
                                                            • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00492B41
                                                            • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00492B61
                                                            • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00492B81
                                                            • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00492BA1
                                                            • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00492BC1
                                                            • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00492BE1
                                                            • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00492C01
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$ErrorLast$DirectorySystem
                                                            • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                            • API String ID: 2510051996-1735120554
                                                            • Opcode ID: 8486b45f8a4f44aa43252e130edb09b810ff77372471b7554d73dff9047fd167
                                                            • Instruction ID: e0ae00181f49e07da1402a4dfc47a9c540c86a66aa650a3d3cfd2bce80e392bc
                                                            • Opcode Fuzzy Hash: 8486b45f8a4f44aa43252e130edb09b810ff77372471b7554d73dff9047fd167
                                                            • Instruction Fuzzy Hash: DF31A170941208EFDB119F62EE06B9A7BA0F714749F11023BE84456270E7F91C559FEE
                                                            Function 00471741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0045C3EB,?,00000000,?,0045C47F), ref: 00471778
                                                            • GetLastError.KERNEL32(?,0045C3EB,?,00000000,?,0045C47F,00455405,?,?,00455445,00455445,00000000,?,00000000), ref: 00471781
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateErrorEventLast
                                                            • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                            • API String ID: 545576003-938279966
                                                            • Opcode ID: 17b39127369ea8650a7f3645940011bb272fc78ae590189aab531aaf5354e619
                                                            • Instruction ID: b4a44139eaefe90fce0b068d0bbd2d0de90d8d3a0ebf198548b732b6b2a17a39
                                                            • Opcode Fuzzy Hash: 17b39127369ea8650a7f3645940011bb272fc78ae590189aab531aaf5354e619
                                                            • Instruction Fuzzy Hash: 26213C77D4063636D321266D4D45FAB659CEB10BA0B128537FD08BB251E75CDC0085EF
                                                            Function 0048FCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0048FCD6
                                                            • GetProcAddress.KERNEL32(SystemFunction041), ref: 0048FCE8
                                                            • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0048FD2B
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0048FD3F
                                                            • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0048FD77
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0048FD8B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$ErrorLast
                                                            • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                            • API String ID: 4214558900-3191127217
                                                            • Opcode ID: 4e15fce81e673c5db8e8865cbda4c5c993255f8e3c21b8539141605d902f6564
                                                            • Instruction ID: cc2939cb5c81dab0fb1ba766bd175e2edf160ce52644b7ee9dabc01adb157caf
                                                            • Opcode Fuzzy Hash: 4e15fce81e673c5db8e8865cbda4c5c993255f8e3c21b8539141605d902f6564
                                                            • Instruction Fuzzy Hash: 1421C832940231BBC731BB16AD05B8F69D0EB40B59F120A37ED01A7260E7EC9C049BED
                                                            Function 004708C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 004708F2
                                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0047090A
                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 0047090F
                                                            • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00470912
                                                            • GetLastError.KERNEL32(?,?), ref: 0047091C
                                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0047098B
                                                            • GetLastError.KERNEL32(?,?), ref: 00470998
                                                            Strings
                                                            • cabextract.cpp, xrefs: 00470940, 004709BC
                                                            • Failed to open cabinet file: %hs, xrefs: 004709C9
                                                            • Failed to add virtual file pointer for cab container., xrefs: 00470971
                                                            • Failed to duplicate handle to cab container., xrefs: 0047094A
                                                            • <the>.cab, xrefs: 004708EB
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                            • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                            • API String ID: 3030546534-3446344238
                                                            • Opcode ID: 52c1f95d7120273ca64ae1253886785e10370e75e9968c4dc3d0e4363fa634de
                                                            • Instruction ID: 57191c1fceab75982e1b76d84da4301d92d132d1d494797c73548ac16c53697e
                                                            • Opcode Fuzzy Hash: 52c1f95d7120273ca64ae1253886785e10370e75e9968c4dc3d0e4363fa634de
                                                            • Instruction Fuzzy Hash: 8C31E3B2942135FBEB205B559D09F9FBA68EF05760F118127FE08B7251D7289C10C6E9
                                                            Function 00466A57 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00454E11,?,?), ref: 00466A77
                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,?,00454E11,?,?), ref: 00466A7D
                                                            • DuplicateHandle.KERNELBASE(00000000,?,?,00454E11,?,?), ref: 00466A80
                                                            • GetLastError.KERNEL32(?,?,00454E11,?,?), ref: 00466A8A
                                                            • CloseHandle.KERNEL32(000000FF,?,00454E11,?,?), ref: 00466B03
                                                            Strings
                                                            • burn.filehandle.attached, xrefs: 00466AD0
                                                            • core.cpp, xrefs: 00466AAE
                                                            • Failed to append the file handle to the command line., xrefs: 00466AEB
                                                            • Failed to duplicate file handle for attached container., xrefs: 00466AB8
                                                            • %ls -%ls=%u, xrefs: 00466AD7
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentHandleProcess$CloseDuplicateErrorLast
                                                            • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
                                                            • API String ID: 4224961946-4196573879
                                                            • Opcode ID: f3c01b359ea8bfd487a4d45309347d2e1b7a26ebbcef61e19eb598efb86557ce
                                                            • Instruction ID: e67729f328324c531f0ace372e825176e2dff16ba8d36ec06d839a45f19645b4
                                                            • Opcode Fuzzy Hash: f3c01b359ea8bfd487a4d45309347d2e1b7a26ebbcef61e19eb598efb86557ce
                                                            • Instruction Fuzzy Hash: 9C11A272940225FBCB10ABE59D09E5E7B68DB16B30F214267FD20F72D0E7789D0086D9
                                                            Function 00499AA6 Relevance: 15.1, APIs: 10, Instructions: 124libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryExA.KERNELBASE ref: 00499AA6
                                                            • GetLastError.KERNEL32 ref: 00499AB2
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00499AE1
                                                            • RaiseException.KERNEL32(C06D007E,?,00000001,?), ref: 00499AF2
                                                            • FreeLibrary.KERNEL32(00000000), ref: 00499B0C
                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00499B74
                                                            • GetLastError.KERNEL32 ref: 00499B80
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00499BAF
                                                            • RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 00499BC0
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00499BF7
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AccessDloadReleaseSectionWrite$ErrorExceptionLastLibraryRaise$AddressFreeLoadProc
                                                            • String ID:
                                                            • API String ID: 202095176-0
                                                            • Opcode ID: 78c40e639af5b6faad1061f0882d0caa32278f8a1ab4a5e95357cc2af030a26c
                                                            • Instruction ID: afcf8489e35d9844115bd0f3fc0b30136c8bf3125e8b00ee280ce8b4f25c3cf8
                                                            • Opcode Fuzzy Hash: 78c40e639af5b6faad1061f0882d0caa32278f8a1ab4a5e95357cc2af030a26c
                                                            • Instruction Fuzzy Hash: CC414C35900219AFCF21DFA8E9949AE7BB4FF58750B05417FE901A7350DB78AD00CB94
                                                            Function 00490879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • OpenProcessToken.ADVAPI32(?,00000008,?,004553BD,00000000,?,?,?,?,?,?,?,0046769D,00000000), ref: 00490897
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,0046769D,00000000), ref: 004908A1
                                                            • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,0046769D,00000000), ref: 004908D3
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,0046769D,00000000), ref: 004908EC
                                                            • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,0046769D,00000000), ref: 0049092B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                            • String ID: procutil.cpp
                                                            • API String ID: 4040495316-1178289305
                                                            • Opcode ID: ac9ec0f59c972c277083b8ef460b091e60036040c946ab8a5d3ee472ce92f3d5
                                                            • Instruction ID: fe3ae9cb99bdaf08dac5daf8e1e65a3418e54289b315ea5514b276afd9eeb5d7
                                                            • Opcode Fuzzy Hash: ac9ec0f59c972c277083b8ef460b091e60036040c946ab8a5d3ee472ce92f3d5
                                                            • Instruction Fuzzy Hash: AE21A472E40229EFDB21AB999905A9FBFB8EF10711F114177ED14AB351D3748E00DAD8
                                                            Function 00466B13 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00466B49
                                                            • CloseHandle.KERNEL32(00000000), ref: 00466BB9
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateFileHandle
                                                            • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
                                                            • API String ID: 3498533004-3263533295
                                                            • Opcode ID: 6ffc0d44aa9c13482986f8a19570478032929713727a93a19e27d7bcdc9f1440
                                                            • Instruction ID: ac2206ac318221f72c0c91bda9c5c2ed1482367cec7e8bbb6aaebee4a1d6bc89
                                                            • Opcode Fuzzy Hash: 6ffc0d44aa9c13482986f8a19570478032929713727a93a19e27d7bcdc9f1440
                                                            • Instruction Fuzzy Hash: 7C110332600224BBCB205A68DD05F5B7BACDF45B34F120367FD28EB2E1E7785911869A
                                                            Function 00493565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CoInitialize.OLE32(00000000), ref: 00493574
                                                            • InterlockedIncrement.KERNEL32(004BB6C8), ref: 00493591
                                                            • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,004BB6B8,?,?,?,?,?,?), ref: 004935AC
                                                            • CLSIDFromProgID.OLE32(MSXML.DOMDocument,004BB6B8,?,?,?,?,?,?), ref: 004935B8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FromProg$IncrementInitializeInterlocked
                                                            • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                            • API String ID: 2109125048-2356320334
                                                            • Opcode ID: 9e032f70b0db6941cf9bc08c836408d5a0180a49207749284d87f21014bb5b45
                                                            • Instruction ID: 62d1925a2e89c78119792251fbdce40ebd2d2dadf40d5b25447ce43fb8b14feb
                                                            • Opcode Fuzzy Hash: 9e032f70b0db6941cf9bc08c836408d5a0180a49207749284d87f21014bb5b45
                                                            • Instruction Fuzzy Hash: EEF0A020740125BBCB214F627E09B572EA5DB9AB76F12053BEC00C2150D7ACC94186FD
                                                            Function 00494A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00494A9D
                                                            • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00494ACA
                                                            • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00494AF6
                                                            • GetLastError.KERNEL32(00000000,0049B7A0,?,00000000,?,00000000,?,00000000), ref: 00494B34
                                                            • GlobalFree.KERNEL32(00000000), ref: 00494B65
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Global$AllocFree
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 1145190524-2967768451
                                                            • Opcode ID: 0d89352b5cf32ca3a652deb8bce336abc44cfd87de20efbce5d8f51f8ac5d85c
                                                            • Instruction ID: 505da6431fd4addfaa957bd41ce8903369596500be1285c4a8fb3e1c92f4730c
                                                            • Opcode Fuzzy Hash: 0d89352b5cf32ca3a652deb8bce336abc44cfd87de20efbce5d8f51f8ac5d85c
                                                            • Instruction Fuzzy Hash: ED317236940229AB8B119A99CC41FAFBEA8EF84750F114177FD14E7341D638ED0186E9
                                                            Function 00470A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00470B27
                                                            • GetLastError.KERNEL32(?,?,?), ref: 00470B31
                                                            Strings
                                                            • cabextract.cpp, xrefs: 00470B55
                                                            • Invalid seek type., xrefs: 00470ABD
                                                            • Failed to move file pointer 0x%x bytes., xrefs: 00470B62
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastPointer
                                                            • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                            • API String ID: 2976181284-417918914
                                                            • Opcode ID: c15f4b3cb7a18e2487823fb1d343f1c6706099c5ff063ff078ee7c5f647c7b84
                                                            • Instruction ID: d5b3288b45ae9bc800dee91ebc213b8bc73c66456b56b48519abe8964d72c838
                                                            • Opcode Fuzzy Hash: c15f4b3cb7a18e2487823fb1d343f1c6706099c5ff063ff078ee7c5f647c7b84
                                                            • Instruction Fuzzy Hash: 40319031A4121AEFCB10DFA8D845EAEB769FB04724B14C127F91897251D338FE118BD9
                                                            Function 00454115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?), ref: 00454123
                                                            • GetLastError.KERNEL32(?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?,00000000,00000000), ref: 00454131
                                                            • CreateDirectoryW.KERNEL32(?,840F01E8,00455489,?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?,00000000), ref: 0045419A
                                                            • GetLastError.KERNEL32(?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?,00000000,00000000), ref: 004541A4
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateDirectoryErrorLast
                                                            • String ID: dirutil.cpp
                                                            • API String ID: 1375471231-2193988115
                                                            • Opcode ID: 8f8ad712624f7445868bc01b456a7887417f3e25bbd244950259577c76a9403d
                                                            • Instruction ID: c1aa6b1681c0c6e68daad275f6b7f4b646c9fefc84e4e1a5c1d5953f7c590043
                                                            • Opcode Fuzzy Hash: 8f8ad712624f7445868bc01b456a7887417f3e25bbd244950259577c76a9403d
                                                            • Instruction Fuzzy Hash: F211D426600B35A6D6311AA25C4873BB654DBB5BABF114037FD049E242E2688CC582DD
                                                            Function 004556A9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00456595,00456595,?,0045563D,?,?,00000000), ref: 004556E5
                                                            • GetLastError.KERNEL32(?,0045563D,?,?,00000000,?,?,00456595,?,00457F02,?,?,?,?,?), ref: 00455714
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareErrorLastString
                                                            • String ID: Failed to compare strings.$variable.cpp$version.dll
                                                            • API String ID: 1733990998-4228644734
                                                            • Opcode ID: c770c15bff9a40a63a4ab8bd59732a0d6ef57d77bd8c6e8119f7ca0686d0bc3d
                                                            • Instruction ID: 75bc5b4f95efefad87c72b03aaef5099707e847a2b784dd4219f9ae03fe91bfa
                                                            • Opcode Fuzzy Hash: c770c15bff9a40a63a4ab8bd59732a0d6ef57d77bd8c6e8119f7ca0686d0bc3d
                                                            • Instruction Fuzzy Hash: E5210A36640515EFC7148F98CD55A6ABBA4EB09762F21032AFD24AB391E634EE018698
                                                            Function 00490A28 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00454F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00490A38
                                                            • GetLastError.KERNEL32(?,?,00454F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00490A46
                                                            • GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 00490A8B
                                                            • GetLastError.KERNEL32(?,?,00454F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00490A95
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeExitObjectProcessSingleWait
                                                            • String ID: procutil.cpp
                                                            • API String ID: 590199018-1178289305
                                                            • Opcode ID: 261af9bb6a29914190b3b3762319aa6f6a8b7ff604cfa1d5874b4c4ce86d3cef
                                                            • Instruction ID: f23df33b15aac8f7e0e61df71ae503357b16bec775b64210b0ac21c73dd906ae
                                                            • Opcode Fuzzy Hash: 261af9bb6a29914190b3b3762319aa6f6a8b7ff604cfa1d5874b4c4ce86d3cef
                                                            • Instruction Fuzzy Hash: A7117037D41335EFCB208B959909A9F7EA4EF24760F124277FD54AB390D2389D0096D9
                                                            Function 004709EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0047140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00470A19,?,?,?), ref: 00471434
                                                              • Part of subcall function 0047140C: GetLastError.KERNEL32(?,00470A19,?,?,?), ref: 0047143E
                                                            • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00470A27
                                                            • GetLastError.KERNEL32 ref: 00470A31
                                                            Strings
                                                            • cabextract.cpp, xrefs: 00470A55
                                                            • Failed to read during cabinet extraction., xrefs: 00470A5F
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$PointerRead
                                                            • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                            • API String ID: 2170121939-2426083571
                                                            • Opcode ID: f8712df12174f7f5dc4f3a6eb93e07ea1b8e7de4aae9ecd0431ee61eb4e6f7d4
                                                            • Instruction ID: 16e7467c592d5892353dbf61f1aa972330b2ba602c698085b19e32a9bfb8fac1
                                                            • Opcode Fuzzy Hash: f8712df12174f7f5dc4f3a6eb93e07ea1b8e7de4aae9ecd0431ee61eb4e6f7d4
                                                            • Instruction Fuzzy Hash: BB110E36A01229FBCB209F95DC04E9E3F68FB08760F11816AFD08A7250D3389910C6E8
                                                            Function 0047140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00470A19,?,?,?), ref: 00471434
                                                            • GetLastError.KERNEL32(?,00470A19,?,?,?), ref: 0047143E
                                                            Strings
                                                            • cabextract.cpp, xrefs: 00471462
                                                            • Failed to move to virtual file pointer., xrefs: 0047146C
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastPointer
                                                            • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                            • API String ID: 2976181284-3005670968
                                                            • Opcode ID: d5cc6a7d65f2c5a642992c37c9e3d6f0d8ac50c957b4f28626db16193994ac32
                                                            • Instruction ID: 5417a89f6d7838ac4d6ac030a78f13cf1304bcb514894decc9d38beea79ab678
                                                            • Opcode Fuzzy Hash: d5cc6a7d65f2c5a642992c37c9e3d6f0d8ac50c957b4f28626db16193994ac32
                                                            • Instruction Fuzzy Hash: AE01A7375406357BC7215A9A9C08ADBBF28EF10B71711C12BFD1C66221D7399C10C6D9
                                                            Function 00493EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00493F73
                                                            • GetLastError.KERNEL32 ref: 00493FD6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastRead
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 1948546556-2967768451
                                                            • Opcode ID: b292f7e5aa575f1c61b867ca2678bf1468fe331ea80ba234a0b4ce9d09c5ae10
                                                            • Instruction ID: 1a11bc859ee8d2779d3dd882c5e7a1f8bde3537546b57e3d01f926abbfe4df04
                                                            • Opcode Fuzzy Hash: b292f7e5aa575f1c61b867ca2678bf1468fe331ea80ba234a0b4ce9d09c5ae10
                                                            • Instruction Fuzzy Hash: 5E318F71E002699BDF21CE15C940BEA7BB4FB45752F0041BBFA48E7244D7B89EC48A99
                                                            Function 00494E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00493F9A,?,?,?), ref: 00494E5E
                                                            • GetLastError.KERNEL32(?,?,00493F9A,?,?,?), ref: 00494E68
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastWrite
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 442123175-2967768451
                                                            • Opcode ID: 00e6928fb5b4c1accfdb584c360db937c976257eee02566553ceadf9610888b7
                                                            • Instruction ID: 327d81ae2994662c145fae5d4fa5268c0d4ab80afbb4c9f79ac8a73ac52f8e61
                                                            • Opcode Fuzzy Hash: 00e6928fb5b4c1accfdb584c360db937c976257eee02566553ceadf9610888b7
                                                            • Instruction Fuzzy Hash: 8EF04B33A00229ABCB209E9ADD45EEFBB6DFB94761F110126FD04D7240D724AA0186E4
                                                            Function 0049490D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00468770,00000000,00000000,00000000,00000000,00000000), ref: 00494925
                                                            • GetLastError.KERNEL32(?,?,?,00468770,00000000,00000000,00000000,00000000,00000000), ref: 0049492F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastPointer
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 2976181284-2967768451
                                                            • Opcode ID: 1ab9c9dd86fffac4aa5feb33d8c527b43262a8d494fbd70170397b2ae61a1593
                                                            • Instruction ID: 1ffbc33158429de8bb86d909aef1a491cfa109eb1b333916cb5f5ea4ac6c9637
                                                            • Opcode Fuzzy Hash: 1ab9c9dd86fffac4aa5feb33d8c527b43262a8d494fbd70170397b2ae61a1593
                                                            • Instruction Fuzzy Hash: AAF0D6B6600129AB8F108F95DD05DAF7FA8EF44760B01416ABD0497310E334DC10D7E4
                                                            Function 00453838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00453877
                                                            • GetLastError.KERNEL32 ref: 00453881
                                                            • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 004538EA
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: DirectoryErrorLastLibraryLoadSystem
                                                            • String ID:
                                                            • API String ID: 1230559179-0
                                                            • Opcode ID: c346dc3438bc4c1bd52b6584b79ef8307c4bdae3c1618d43d8bbc8ae5295ab6a
                                                            • Instruction ID: b725fb19a4baeb2c1611b90a9632c796f27bc638ea2d5c670904ac65980a4bcf
                                                            • Opcode Fuzzy Hash: c346dc3438bc4c1bd52b6584b79ef8307c4bdae3c1618d43d8bbc8ae5295ab6a
                                                            • Instruction Fuzzy Hash: 622106F2D0123DA7CB20AF659C45F9B77A89B00792F1101BBFD14E7242D678DE4886D8
                                                            Function 00453A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00453BB6,00000000,?,00451474,00000000,80004005,00000000,80004005,00000000,000001C7,?,004513B8), ref: 00453A20
                                                            • RtlFreeHeap.NTDLL(00000000,?,00453BB6,00000000,?,00451474,00000000,80004005,00000000,80004005,00000000,000001C7,?,004513B8,000001C7,00000100), ref: 00453A27
                                                            • GetLastError.KERNEL32(?,00453BB6,00000000,?,00451474,00000000,80004005,00000000,80004005,00000000,000001C7,?,004513B8,000001C7,00000100,?), ref: 00453A31
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$ErrorFreeLastProcess
                                                            • String ID:
                                                            • API String ID: 406640338-0
                                                            • Opcode ID: c048bf96329e82c0aa491115953c36f803f42b2fb737e7a9d7fcb533ca1b3c00
                                                            • Instruction ID: d47ff0743bf2ba04ff95a470a424568dbce0675b3f0f79b8f03e2530aee9aaaf
                                                            • Opcode Fuzzy Hash: c048bf96329e82c0aa491115953c36f803f42b2fb737e7a9d7fcb533ca1b3c00
                                                            • Instruction Fuzzy Hash: DCD0C233A001395783201BE66D0D95B7E58EF10AE37014033FD44D6221D725CC0082E8
                                                            Function 00453AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(?,000001C7,?,?,0045226D,?,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000), ref: 00453B04
                                                            • RtlReAllocateHeap.NTDLL(00000000,?,0045226D,?,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453B0B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID:
                                                            • API String ID: 1357844191-0
                                                            • Opcode ID: 98266c56ea2f48786b1525dc5657ff4d2260e871efea25788b6388dc35bb805a
                                                            • Instruction ID: 71d50f10c411a73c4add4e6f99e7db44a60f37fc01885f3f1a18e9b0698d68c2
                                                            • Opcode Fuzzy Hash: 98266c56ea2f48786b1525dc5657ff4d2260e871efea25788b6388dc35bb805a
                                                            • Instruction Fuzzy Hash: 55D0123215420DEBCF005FE8ED0EDBE3BACFB68642704842AF915C2120C73DE4209BA4
                                                            Function 004935C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VariantInit.OLEAUT32(?), ref: 004935F8
                                                              • Part of subcall function 0049304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00493609,00000000,?,00000000), ref: 00493069
                                                              • Part of subcall function 0049304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0047C025,?,00455405,?,00000000,?), ref: 00493075
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorHandleInitLastModuleVariant
                                                            • String ID:
                                                            • API String ID: 52713655-0
                                                            • Opcode ID: 81a2b97d49e4a9c3951d16607e7df061c5feaa794c914ed82388d93f53ff4f06
                                                            • Instruction ID: 2201d8e6d39631dd322dcbac640671974dfc062b3431c7ee7235a6c480136a32
                                                            • Opcode Fuzzy Hash: 81a2b97d49e4a9c3951d16607e7df061c5feaa794c914ed82388d93f53ff4f06
                                                            • Instruction Fuzzy Hash: E0312D76E00229AFCB11DFA9C884ADEBBF8EF09711F01457AED15BB311D6759D008BA4
                                                            Function 004534B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00468BD3,0000001C,80070490,00000000,00000000,80070490), ref: 004534D5
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FolderPath
                                                            • String ID:
                                                            • API String ID: 1514166925-0
                                                            • Opcode ID: 3339c3668ab0a2eec5c710cb8bcc6bf0448ff78d1bff858f60538dd9264b7e95
                                                            • Instruction ID: fb4270a0be7b54c2f53f24c376cb57327b0e5e347b970ade64ac7f3a3202d808
                                                            • Opcode Fuzzy Hash: 3339c3668ab0a2eec5c710cb8bcc6bf0448ff78d1bff858f60538dd9264b7e95
                                                            • Instruction Fuzzy Hash: 19E02B722001243BE7026F625D05DEB3B8CDF06396B008027FE00D2012D37AE50493F9
                                                            Function 00492EFE Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FreeLibrary.KERNELBASE(00000000,00000000,0045556E,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00492F0B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeLibrary
                                                            • String ID:
                                                            • API String ID: 3664257935-0
                                                            • Opcode ID: 894587939b4f58ed2e4494bebbe9be21983a6a29c01f421b0120bb26201de59c
                                                            • Instruction ID: 8a2f38027f1a5e53dd6ee99caea3b8e7d3118f8da6c1f4682ae7e34a05db54f6
                                                            • Opcode Fuzzy Hash: 894587939b4f58ed2e4494bebbe9be21983a6a29c01f421b0120bb26201de59c
                                                            • Instruction Fuzzy Hash: C4E0F6B1D26234DF8B108F69BD455427BB8F718B40304433BB800C2224D7F04C528FEA

                                                            Non-executed Functions

                                                            Function 0045A8F1 Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysFreeString.OLEAUT32(?), ref: 0045B11C
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CompareStringW.KERNEL32(0000007F,00000000,0049CA9C,000000FF,DirectorySearch,000000FF,0049CA9C,Condition,feclient.dll,0049CA9C,Variable,?,0049CA9C,0049CA9C,?,?), ref: 0045AA29
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0045AA7E
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 0045AA9A
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 0045AABE
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0045AB11
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0045AB2B
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 0045AB53
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 0045AB91
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 0045ABB0
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 0045ABCF
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 0045AC8D
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 0045ACA7
                                                              • Part of subcall function 004932F3: VariantInit.OLEAUT32(?), ref: 00493309
                                                              • Part of subcall function 004932F3: SysAllocString.OLEAUT32(?), ref: 00493325
                                                              • Part of subcall function 004932F3: VariantClear.OLEAUT32(?), ref: 004933AC
                                                              • Part of subcall function 004932F3: SysFreeString.OLEAUT32(00000000), ref: 004933B7
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 0045AD06
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 0045AD28
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0045AD48
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 0045AE20
                                                            • SysFreeString.OLEAUT32(?), ref: 0045AFFE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
                                                            • String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ETE$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
                                                            • API String ID: 2748437055-4125508414
                                                            • Opcode ID: a70c8d25c36548027c76ebd244cb04d0723331908aefc19874d1dbe2c6b683a0
                                                            • Instruction ID: 0e1cc4b0e8405e7071c1eedfcdea8573f4667a29cb17ce2bef1c63c52a0c7826
                                                            • Opcode Fuzzy Hash: a70c8d25c36548027c76ebd244cb04d0723331908aefc19874d1dbe2c6b683a0
                                                            • Instruction Fuzzy Hash: 3122C531D88226BACF208A958C42F6F7E64EB01B35F304363FD30B62D2D7689D5496D9
                                                            Function 004741EA Relevance: 43.0, Strings: 34, Instructions: 498COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • feclient.dll, xrefs: 004742C5, 0047434D, 0047441D, 0047454B, 004747D8
                                                            • Failed to add patch properties to argument string., xrefs: 004744FD
                                                            • Failed to enable logging for package: %ls to: %ls, xrefs: 0047441F
                                                            • Failed to build MSI path., xrefs: 0047439D
                                                            • Failed to add the list of dependencies to ignore to the properties., xrefs: 004746CA
                                                            • %ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 00474687
                                                            • Failed to initialize external UI handler., xrefs: 004743F4
                                                            • Failed to install MSI package., xrefs: 00474746
                                                            • Failed to add obfuscated properties to argument string., xrefs: 00474497
                                                            • Failed to add reinstall all property on minor upgrade., xrefs: 004745EA
                                                            • Failed to add reboot suppression property on uninstall., xrefs: 0047477D
                                                            • Failed to uninstall MSI package., xrefs: 004747EF
                                                            • WixBundleExecutePackageAction, xrefs: 004743B7, 004748B4
                                                            • VersionString, xrefs: 0047428E, 004742EF
                                                            • Failed to perform minor upgrade of MSI package., xrefs: 00474638
                                                            • Failed to add feature action properties to obfuscated argument string., xrefs: 004744DB
                                                            • %ls %ls=ALL, xrefs: 004746B6, 00474795
                                                            • WixBundleExecutePackageCacheFolder, xrefs: 0047436A, 004748A4
                                                            • REBOOT=ReallySuppress, xrefs: 004745A0, 0047476C
                                                            • Failed to add properties to argument string., xrefs: 00474463
                                                            • Failed to add ADMIN property on admin install., xrefs: 0047471E
                                                            • Failed to add patch properties to obfuscated argument string., xrefs: 0047451F
                                                            • ACTION=ADMIN, xrefs: 00474709
                                                            • IGNOREDEPENDENCIES, xrefs: 004746A5, 00474784
                                                            • crypt32.dll, xrefs: 0047440A
                                                            • Failed to add reboot suppression property on install., xrefs: 004745BB
                                                            • REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 004745F5
                                                            • Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 0047469B
                                                            • REINSTALL=ALL, xrefs: 004745D3, 0047464D
                                                            • msasn1.dll, xrefs: 0047440B
                                                            • Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 0047460C
                                                            • Failed to add feature action properties to argument string., xrefs: 004744B9
                                                            • Failed to get cached path for package: %ls, xrefs: 0047434F
                                                            • Failed to run maintanance mode for MSI package., xrefs: 004746F6
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
                                                            • API String ID: 0-2033600224
                                                            • Opcode ID: 9adf52b7951d0e772c59a6603c632e4ac1fba5327909795f456cf2da7fa1316c
                                                            • Instruction ID: 81b0db41ff74ff52428dc6debf8d1c65692e11992b240e47f8ad8ef2c4a5f987
                                                            • Opcode Fuzzy Hash: 9adf52b7951d0e772c59a6603c632e4ac1fba5327909795f456cf2da7fa1316c
                                                            • Instruction Fuzzy Hash: 1B02D571940525AFCB219F54CC81FFA776ABB94304F0041ABF90CA7251D73A9EA0CF99
                                                            Function 00491719 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 004917B1
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004917BB
                                                            • CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00491808
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049180E
                                                            • CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00491848
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049184E
                                                            • CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 0049188E
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00491894
                                                            • CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 004918D4
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004918DA
                                                            • CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 0049191A
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00491920
                                                            • SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00491A11
                                                            • SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00491A4B
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00491A55
                                                            • SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00491A8D
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00491A97
                                                            • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00491AD0
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00491ADA
                                                            • CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00491B18
                                                            • LocalFree.KERNEL32(?), ref: 00491B2E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
                                                            • String ID: srputil.cpp
                                                            • API String ID: 267631441-4105181634
                                                            • Opcode ID: 821914d1834918d601dd169ede5c25454eb423824b354f4b9bf257df55af15a2
                                                            • Instruction ID: a293eb9e97dc9fa4c256c40da4dd336095c4a6d51f5f79a2674ec33729c2e9fd
                                                            • Opcode Fuzzy Hash: 821914d1834918d601dd169ede5c25454eb423824b354f4b9bf257df55af15a2
                                                            • Instruction Fuzzy Hash: BAC19576D4123EABDB208B969D48BDFFEB8AF44750F0101BBA914B7250D7749D408EE4
                                                            Function 0047C332 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 376COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • Failed to copy uninstall arguments for related bundle package, xrefs: 0047C623
                                                            • Failed to copy version for pseudo bundle., xrefs: 0047C72D
                                                            • Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 0047C385
                                                            • pseudobundle.cpp, xrefs: 0047C379, 0047C3B2, 0047C4A1, 0047C6D2
                                                            • Failed to copy display name for pseudo bundle., xrefs: 0047C74F
                                                            • Failed to allocate memory for dependency providers., xrefs: 0047C6DE
                                                            • Failed to copy local source path for pseudo bundle., xrefs: 0047C43B
                                                            • Failed to append relation type to repair arguments for related bundle package, xrefs: 0047C5F1
                                                            • Failed to copy install arguments for related bundle package, xrefs: 0047C584
                                                            • Failed to append relation type to install arguments for related bundle package, xrefs: 0047C5A9
                                                            • Failed to append relation type to uninstall arguments for related bundle package, xrefs: 0047C644
                                                            • Failed to copy repair arguments for related bundle package, xrefs: 0047C5D0
                                                            • Failed to copy key for pseudo bundle., xrefs: 0047C542
                                                            • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0047C3BE
                                                            • Failed to copy key for pseudo bundle payload., xrefs: 0047C3F3
                                                            • Failed to copy filename for pseudo bundle., xrefs: 0047C417
                                                            • Failed to allocate memory for pseudo bundle payload hash., xrefs: 0047C4AD
                                                            • Failed to copy download source for pseudo bundle., xrefs: 0047C469
                                                            • Failed to copy cache id for pseudo bundle., xrefs: 0047C55F
                                                            • -%ls, xrefs: 0047C34C
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
                                                            • API String ID: 1357844191-2832335422
                                                            • Opcode ID: 3798fa56b072907f7a4fc9ff791da0cbbf84482ca92dccc465f980daf0db50eb
                                                            • Instruction ID: 4f07c54f979b206fdf884c905d8918c1b8cfa89172f27cd3cb63dcf4321c455e
                                                            • Opcode Fuzzy Hash: 3798fa56b072907f7a4fc9ff791da0cbbf84482ca92dccc465f980daf0db50eb
                                                            • Instruction Fuzzy Hash: 60C1C171640626BBCB159F65C8C1BAA76A8BF09714B10812FFD09EB341DB78EC049BD8
                                                            Function 004545EE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 141sleepshutdownCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00454617
                                                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 0045461E
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00454628
                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00454678
                                                            • GetLastError.KERNEL32 ref: 00454682
                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 004546C6
                                                            • GetLastError.KERNEL32 ref: 004546D0
                                                            • Sleep.KERNEL32(000003E8), ref: 0045470C
                                                            • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 0045471D
                                                            • GetLastError.KERNEL32 ref: 00454727
                                                            • CloseHandle.KERNEL32(?), ref: 0045477D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
                                                            • String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
                                                            • API String ID: 2241679041-1583736410
                                                            • Opcode ID: cc44c928169158cc948c76048cc7456e127bdeed88584e03b225a1679af959f0
                                                            • Instruction ID: 3a2904c6487a277ad5940994a8806cf833ca294d559c44203caa2d398db94728
                                                            • Opcode Fuzzy Hash: cc44c928169158cc948c76048cc7456e127bdeed88584e03b225a1679af959f0
                                                            • Instruction Fuzzy Hash: AB415F73940235ABDB209BE55D8AB6F7A58EB4575AF11013BFE00BF242D72C4C4485ED
                                                            Function 00464EDF Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 165pipeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00464F0D
                                                            • GetLastError.KERNEL32(?,00000000,?,?,0045452F,?), ref: 00464F16
                                                            • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,0045452F,?), ref: 00464FB8
                                                            • GetLastError.KERNEL32(?,0045452F,?), ref: 00464FC5
                                                            • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,0045452F), ref: 00465040
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,0045452F,?), ref: 0046504B
                                                            • CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,0045452F,?), ref: 0046508B
                                                            • LocalFree.KERNEL32(00000000,?,0045452F,?), ref: 004650B9
                                                            Strings
                                                            • \\.\pipe\%ls.Cache, xrefs: 0046500C
                                                            • Failed to create pipe: %ls, xrefs: 00464FF6, 0046507C
                                                            • \\.\pipe\%ls, xrefs: 00464F6E
                                                            • pipe.cpp, xrefs: 00464F3A, 00464FE9, 0046506F
                                                            • D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00464F08
                                                            • Failed to allocate full name of cache pipe: %ls, xrefs: 00465022
                                                            • Failed to allocate full name of pipe: %ls, xrefs: 00464F84
                                                            • Failed to create the security descriptor for the connection event and pipe., xrefs: 00464F44
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
                                                            • String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
                                                            • API String ID: 1214480349-3253666091
                                                            • Opcode ID: c8aba339affac9b979ece48206a866c0de573a7f10c910666722f4bfa81ccfd5
                                                            • Instruction ID: 798d2f35805db02ad9c3f6ff0a3cc233cfbe740b634c41f7e71c77ecd3cfe550
                                                            • Opcode Fuzzy Hash: c8aba339affac9b979ece48206a866c0de573a7f10c910666722f4bfa81ccfd5
                                                            • Instruction Fuzzy Hash: C051E732E40625FBDF219B95DC46F9E7A64EF54720F200167FD00B62D1E3B99E408ADA
                                                            Function 0048FA62 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 173encryptionfileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00469F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 0048FAC7
                                                            • GetLastError.KERNEL32 ref: 0048FAD1
                                                            • CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0048FB0E
                                                            • GetLastError.KERNEL32 ref: 0048FB18
                                                            • CryptHashData.ADVAPI32(?,?,?,00000000), ref: 0048FB5F
                                                            • ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 0048FB83
                                                            • GetLastError.KERNEL32 ref: 0048FB8D
                                                            • CryptDestroyHash.ADVAPI32(00000000), ref: 0048FBCA
                                                            • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0048FBE1
                                                            • GetLastError.KERNEL32 ref: 0048FBFC
                                                            • CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0048FC34
                                                            • GetLastError.KERNEL32 ref: 0048FC3E
                                                            • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0048FC77
                                                            • GetLastError.KERNEL32 ref: 0048FC85
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
                                                            • String ID: cryputil.cpp
                                                            • API String ID: 3955742341-2185294990
                                                            • Opcode ID: 11502f69c64172e8e3e192f8de1a880e068f8a504c18478274c5f0177103ad9d
                                                            • Instruction ID: 8caffac785dec35be2266b12f17ac6421618e8fd01b1950af560e3923707bfc3
                                                            • Opcode Fuzzy Hash: 11502f69c64172e8e3e192f8de1a880e068f8a504c18478274c5f0177103ad9d
                                                            • Instruction Fuzzy Hash: 5351D437D40139ABDB319A519D09BDF7AA4FB04751F0145B7BE48FA240E3789D848BE8
                                                            Function 00469E9E Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • Failed to move verified file to complete payload path: %ls, xrefs: 0046A06C
                                                            • Failed to reset permissions on unverified cached payload: %ls, xrefs: 00469FF1
                                                            • Failed to create unverified path., xrefs: 00469F6E
                                                            • copying, xrefs: 0046A030, 0046A038
                                                            • Failed to get cached path for package with cache id: %ls, xrefs: 00469EC8
                                                            • Failed to concat complete cached path., xrefs: 00469EF4
                                                            • moving, xrefs: 0046A029
                                                            • Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00469FCB
                                                            • Failed to transfer working path to unverified path for payload: %ls., xrefs: 00469FA4
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
                                                            • API String ID: 0-1289240508
                                                            • Opcode ID: be9f1a69f184e6061bf1579146bc432f819e5ba8db20bedebe939b928d8a8557
                                                            • Instruction ID: 1759f72ebb5ac50bb4aa6dfd604278ce8b1cac0b9b49960a91a692e45c9c4083
                                                            • Opcode Fuzzy Hash: be9f1a69f184e6061bf1579146bc432f819e5ba8db20bedebe939b928d8a8557
                                                            • Instruction Fuzzy Hash: FE516A31900519BADF226E90CC02FAE7B75AF14704F250067F900B51A1E77A9EA1AB9B
                                                            Function 004562AA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetVersionExW.KERNEL32(0000011C), ref: 004562F8
                                                            • GetLastError.KERNEL32 ref: 00456302
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastVersion
                                                            • String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 305913169-1971907631
                                                            • Opcode ID: 7fa18070588239ccede7e36e7ccbb1f1c7ab670ef1e850fe2e278aa2840ddb16
                                                            • Instruction ID: aa3d07c3477c7a0841fdd24bf67d92be390bd8a5548b5e8de0a6834f34adca71
                                                            • Opcode Fuzzy Hash: 7fa18070588239ccede7e36e7ccbb1f1c7ab670ef1e850fe2e278aa2840ddb16
                                                            • Instruction Fuzzy Hash: 0A410871A00228ABCB209B59DC45FEF7FB8EB45711F4101ABFC05E7142D6389E85CB99
                                                            Function 0048FEC6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(004BB5FC,00000000,?,?,?,?,004712CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0048FEF4
                                                            • GetCurrentProcessId.KERNEL32(00000000,?,004712CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0048FF04
                                                            • GetCurrentThreadId.KERNEL32 ref: 0048FF0D
                                                            • GetLocalTime.KERNEL32(8007139F,?,004712CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0048FF23
                                                            • LeaveCriticalSection.KERNEL32(004BB5FC,004712CF,?,00000000,0000FDE9,?,004712CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0049001A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                            • String ID: $eK$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(eK$,eK$0eK
                                                            • API String ID: 296830338-3011604756
                                                            • Opcode ID: 00a07d2feaf0e5bb6f1b4fcedd21264195d138fb1fb7dadd933b9dafabf1afbc
                                                            • Instruction ID: 63006b1a37b92d3cd1d9fddab1769a2806fa543201f115ed708d74bba7552f31
                                                            • Opcode Fuzzy Hash: 00a07d2feaf0e5bb6f1b4fcedd21264195d138fb1fb7dadd933b9dafabf1afbc
                                                            • Instruction Fuzzy Hash: 7A419031D00219AFCF219FA5E805ABFBBB4EB08715F104537FA01A6250D73C9D45DBA9
                                                            Function 00456037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemTime.KERNEL32(?), ref: 00456062
                                                            • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00456076
                                                            • GetLastError.KERNEL32 ref: 00456088
                                                            • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 004560DC
                                                            • GetLastError.KERNEL32 ref: 004560E6
                                                            Strings
                                                            • Failed to allocate the buffer for the Date., xrefs: 004560C4
                                                            • Failed to get the required buffer length for the Date., xrefs: 004560AD
                                                            • Failed to get the Date., xrefs: 0045610B
                                                            • variable.cpp, xrefs: 004560A3, 00456101
                                                            • Failed to set variant value., xrefs: 00456124
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: DateErrorFormatLast$SystemTime
                                                            • String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 2700948981-3682088697
                                                            • Opcode ID: f108c5123af681c1b15f3a5c9a7d1618d065257b90e7eec721ba9ccf2408b974
                                                            • Instruction ID: aeb30e5b1d0f327f3f9ce6e846032a275168176e826c3655fdccc5ac62da2336
                                                            • Opcode Fuzzy Hash: f108c5123af681c1b15f3a5c9a7d1618d065257b90e7eec721ba9ccf2408b974
                                                            • Instruction Fuzzy Hash: 1031FC32A406257BDF219BAA9D42FBF7A68EB04711F51013BFE01F7282D6289D0446E9
                                                            Function 00469B43 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00469BF2
                                                            • lstrlenW.KERNEL32(?), ref: 00469C19
                                                            • FindNextFileW.KERNEL32(00000000,00000010), ref: 00469C79
                                                            • FindClose.KERNEL32(00000000), ref: 00469C84
                                                              • Part of subcall function 00453CC4: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 00453D40
                                                              • Part of subcall function 00453CC4: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00453D53
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
                                                            • String ID: *.*$.unverified
                                                            • API String ID: 457978746-2528915496
                                                            • Opcode ID: 0a591cd1a748845604646c6199b15f152314073f90962a73a4b1bac0646ec61b
                                                            • Instruction ID: 92c98d0900ecae4d0465c996095615532814b02d9d35115d74c4f621285d612b
                                                            • Opcode Fuzzy Hash: 0a591cd1a748845604646c6199b15f152314073f90962a73a4b1bac0646ec61b
                                                            • Instruction Fuzzy Hash: 5241743090052CAEDB21AB65DD49BEA77B8EF44705F1001B7E808E11A0EBB99EC49F5D
                                                            Function 0049887B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 004988D0
                                                            • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 004988E2
                                                            Strings
                                                            • feclient.dll, xrefs: 004988AA
                                                            • %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 0049892D
                                                            • crypt32.dll, xrefs: 004988A0
                                                            • %04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 004988B9
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Time$InformationLocalSpecificSystemZone
                                                            • String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
                                                            • API String ID: 1772835396-1985132828
                                                            • Opcode ID: d888f331f6254e0e7e51b5d63237c28ecd6c03d631e4ea024793243e4a530ee0
                                                            • Instruction ID: e0244e9c851c4fa5f4d128b945625b3874ea76574564b8cd46457344ccf562cb
                                                            • Opcode Fuzzy Hash: d888f331f6254e0e7e51b5d63237c28ecd6c03d631e4ea024793243e4a530ee0
                                                            • Instruction Fuzzy Hash: 1F2119A6900128EADB20DB9ADC05FBBB3FCEB5C711F0045AAB945D2190E63C9A80D774
                                                            Function 0048AA0E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: __floor_pentium4
                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                            • API String ID: 4168288129-2761157908
                                                            • Opcode ID: 8452a65fba37e8b9da13c0688508441b7a38c15499fb87af7d8cf65bab8c82bb
                                                            • Instruction ID: 1c405d24cf7f8e4942b2ff433a9aa2f151dfb406cbda6fa072658a695a91f8fe
                                                            • Opcode Fuzzy Hash: 8452a65fba37e8b9da13c0688508441b7a38c15499fb87af7d8cf65bab8c82bb
                                                            • Instruction Fuzzy Hash: CEC23871E046288FDB25EE289D407EEB7B5EB45305F1449EBD80DE7240E778AE818F85
                                                            Function 004561DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastNameUser
                                                            • String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 2054405381-1522884404
                                                            • Opcode ID: b9d8a574dcb66779c7d44f001772e80985968c5b4b0aec30d0161840bce39361
                                                            • Instruction ID: 9f61aca8914f6153f678a818bdcc7e76aa9107595babb9ab22ae46884389cb32
                                                            • Opcode Fuzzy Hash: b9d8a574dcb66779c7d44f001772e80985968c5b4b0aec30d0161840bce39361
                                                            • Instruction Fuzzy Hash: AC01FE32E4123867CB20EB559C45B9F77A89B00711F1102BBFC04E7242DA7C9D448ADD
                                                            Function 0048FE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,004904F4,?,?,?,?,00000001), ref: 0048FE40
                                                            • GetLastError.KERNEL32(?,004904F4,?,?,?,?,00000001,?,00455616,?,?,00000000,?,?,00455395,00000002), ref: 0048FE4C
                                                            • LocalFree.KERNEL32(00000000,?,?,00000000,?,?,004904F4,?,?,?,?,00000001,?,00455616,?,?), ref: 0048FEB5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFormatFreeLastLocalMessage
                                                            • String ID: logutil.cpp
                                                            • API String ID: 1365068426-3545173039
                                                            • Opcode ID: 4ddb6954e2c753358382c6f0ca6d93aee0f8a7e1ce246a6db3252ca948cca13d
                                                            • Instruction ID: 614c982cb1b306468955bc010efdbc77494155d6702e143133d9993bc249a684
                                                            • Opcode Fuzzy Hash: 4ddb6954e2c753358382c6f0ca6d93aee0f8a7e1ce246a6db3252ca948cca13d
                                                            • Instruction Fuzzy Hash: BE119D32A00129EBDB21AF819D05EBF7A68EF14711F01842BFD0496262D7358E20D7A8
                                                            Function 00476B88 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00476B32,00000000,00000003), ref: 00476B9F
                                                            • GetLastError.KERNEL32(?,00476B32,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00476F28,?), ref: 00476BA9
                                                            Strings
                                                            • Failed to set service start type., xrefs: 00476BD7
                                                            • msuengine.cpp, xrefs: 00476BCD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ChangeConfigErrorLastService
                                                            • String ID: Failed to set service start type.$msuengine.cpp
                                                            • API String ID: 1456623077-1628545019
                                                            • Opcode ID: f37d40d658e312fa309012392baca8e176245bb38683358caf30523dd8e19b56
                                                            • Instruction ID: 97d08cea9f25f88b98b7b4a8644992e494edf1816913a79756e3044fef02e650
                                                            • Opcode Fuzzy Hash: f37d40d658e312fa309012392baca8e176245bb38683358caf30523dd8e19b56
                                                            • Instruction Fuzzy Hash: 19F0A733A4553537872026965C05A8F7D489F12BB1B124337FD38EA2D1EA599D0481EC
                                                            Function 00483C76 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00483D6E
                                                            • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00483D78
                                                            • UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00483D85
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                            • String ID:
                                                            • API String ID: 3906539128-0
                                                            • Opcode ID: 02c3315ca9b665eab3608c96409fee1a1a39e434532ecd12184bfb4771381886
                                                            • Instruction ID: d81bf0d591fbac6bb6f9e19c4b467b486286f0aa2798d5921f4e41866f795c96
                                                            • Opcode Fuzzy Hash: 02c3315ca9b665eab3608c96409fee1a1a39e434532ecd12184bfb4771381886
                                                            • Instruction Fuzzy Hash: 8331E67090122C9BCB21DF65D988BCDBBB8FF08710F5045EAE80CA6251E7349F818F48
                                                            Function 00487B87 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: /
                                                            • API String ID: 0-2043925204
                                                            • Opcode ID: e66cac1ac2a3254d1e3f356b6afc877bf7aec2f8d8b29a4e09969c199f2e9725
                                                            • Instruction ID: f0a408ba8b64304aa4814e20eb65b9b268c89a44c0e58188804b458ef0cce674
                                                            • Opcode Fuzzy Hash: e66cac1ac2a3254d1e3f356b6afc877bf7aec2f8d8b29a4e09969c199f2e9725
                                                            • Instruction Fuzzy Hash: 9C413A725042186FCB20AF79CC99EBF77B9EB80354F204A6AF915C7281E635DD41CB58
                                                            Function 0048A560 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                            • Instruction ID: fcc399f63fc782062f5b115454d0b4da119576c0a49d12be4cc9845f5049b63c
                                                            • Opcode Fuzzy Hash: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
                                                            • Instruction Fuzzy Hash: F4026B71E002199FDF14DFA9C8806AEB7F1EF88314F25856BD819E7340E774AD118B95
                                                            Function 00493A5F Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00493BF1: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00493A8E,?), ref: 00493C62
                                                            • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00493AB2
                                                            • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00493AC3
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AllocateCheckCloseInitializeMembershipToken
                                                            • String ID:
                                                            • API String ID: 2114926846-0
                                                            • Opcode ID: 394e2d4c1b8fd0c5acafade2ff6b73335c48a3dc3ebd1e89de371228add62922
                                                            • Instruction ID: cdb19d43dfb296b80d2be10fcad51f7bf876be7a1bceb5152ed347f863de38ba
                                                            • Opcode Fuzzy Hash: 394e2d4c1b8fd0c5acafade2ff6b73335c48a3dc3ebd1e89de371228add62922
                                                            • Instruction Fuzzy Hash: 2B11277190021AABDF10EFA5DD85AAFBBB8EF08705F50483EA541A6241E7749A408B99
                                                            Function 00494440 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FindFirstFileW.KERNEL32(0047923A,?,00000100,00000000,00000000), ref: 0049447B
                                                            • FindClose.KERNEL32(00000000), ref: 00494487
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Find$CloseFileFirst
                                                            • String ID:
                                                            • API String ID: 2295610775-0
                                                            • Opcode ID: 89f2a172a27257449d9af0d388f5e1a10496214beaef7b04aef5f30f0663d97e
                                                            • Instruction ID: 79929df6883a74831635c8d06361d1d19e8a852aa577a2ae4560f08d565efb15
                                                            • Opcode Fuzzy Hash: 89f2a172a27257449d9af0d388f5e1a10496214beaef7b04aef5f30f0663d97e
                                                            • Instruction Fuzzy Hash: 8201F93160020CABCF10EFA6ED89EABB7ACEBC5319F000176F918D3280D7385D498798
                                                            Function 00482C18 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 0$comres.dll
                                                            • API String ID: 0-3030269839
                                                            • Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                            • Instruction ID: b602c0ae09539b1c4a1c1be0cb900543c946cd7c4b77c3e86ef4df6d2a020645
                                                            • Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
                                                            • Instruction Fuzzy Hash: 0A515670200A055BDB387968879A7BF2BC59B16744F180D1FE842DB382C6CDDF42935E
                                                            Function 0048EE7C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0048EE77,?,?,00000008,?,?,0048EB17,00000000), ref: 0048F0A9
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ExceptionRaise
                                                            • String ID:
                                                            • API String ID: 3997070919-0
                                                            • Opcode ID: 52d598659626c686f5c6fb759e34ed4be697b74b98bc1598f30b2bffb8953810
                                                            • Instruction ID: 9fa619886de59381a35e217bbfd95a3d3faf2095f25a78ef94f790c3dc4f56a2
                                                            • Opcode Fuzzy Hash: 52d598659626c686f5c6fb759e34ed4be697b74b98bc1598f30b2bffb8953810
                                                            • Instruction Fuzzy Hash: D4B18E31210608DFD715DF28C48AB697BE0FF05324F258A69E999CF3A2C339D986CB44
                                                            Function 0047EC07 Relevance: 1.6, APIs: 1, Instructions: 133COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0047EC20
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FeaturePresentProcessor
                                                            • String ID:
                                                            • API String ID: 2325560087-0
                                                            • Opcode ID: cb9fc17ed1e9833c97f95bf66360d4635229d58c0c6651623e8fc941b407f741
                                                            • Instruction ID: a63e544f7e034841d9a329674c1b891eb0bc96a410ffb9c17b41fb284b12d91a
                                                            • Opcode Fuzzy Hash: cb9fc17ed1e9833c97f95bf66360d4635229d58c0c6651623e8fc941b407f741
                                                            • Instruction Fuzzy Hash: E9516C719003059FEB29CF5AD8856AABBF4FB48314F14C2AAD409EB250D379ED20CF59
                                                            Function 0047E9DC Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetUnhandledExceptionFilter.KERNEL32(Function_0002E9E8,0047E131), ref: 0047E9E1
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ExceptionFilterUnhandled
                                                            • String ID:
                                                            • API String ID: 3192549508-0
                                                            • Opcode ID: 6b6a8ce9a299be656b05844b693edb85ebfb493dabc066c7517aaa76dacaa971
                                                            • Instruction ID: 5a7e9a9b40c75e68f5fe9a6e4d02a2a827951ed90d0a83fe03ae4d84133928b2
                                                            • Opcode Fuzzy Hash: 6b6a8ce9a299be656b05844b693edb85ebfb493dabc066c7517aaa76dacaa971
                                                            • Instruction Fuzzy Hash:
                                                            Function 0047FB89 Relevance: .5, Instructions: 481COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: fef913ab84a97eb8d0af717fc49c781e77e6b43b9ae6c97f98b38eb3fd7fe080
                                                            • Instruction ID: 69881806a7dbc8d099cde0bbf5b375b61916c9ca3b6033779ecf20bab754aafb
                                                            • Opcode Fuzzy Hash: fef913ab84a97eb8d0af717fc49c781e77e6b43b9ae6c97f98b38eb3fd7fe080
                                                            • Instruction Fuzzy Hash: EF02F9321081A20BDB2D463984700BB7BE16A433B171E876FD8BBCF2D6DE18D569D764
                                                            Function 00480B6F Relevance: .4, Instructions: 352COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                            • Instruction ID: f2fe94dc2308d7f3e40dc530533641c95f2e7f83ce26cdde6d995510f3ca1b4f
                                                            • Opcode Fuzzy Hash: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
                                                            • Instruction Fuzzy Hash: 41C183331151A20AEFAD5639843403FBBE15A923B131A0F9FD4B2CB2D5EE28953DD724
                                                            Function 004807AA Relevance: .3, Instructions: 347COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                            • Instruction ID: 6f678bde7e4a8355a4a04d578acc10416bb71eb6ddd3e4319bf8ed40d1d84d8f
                                                            • Opcode Fuzzy Hash: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
                                                            • Instruction Fuzzy Hash: 07C1A2331151A20AEFAD5239843407FBBA15E923B031A1B9FD4F2CB2D5EE28957DD724
                                                            Function 004803D5 Relevance: .3, Instructions: 331COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                            • Instruction ID: b846b60eaedda0e31c685cbecb71bd717856afa16e4b5d1bade10f430e40d3b7
                                                            • Opcode Fuzzy Hash: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
                                                            • Instruction Fuzzy Hash: 33C1B7331150A21BEFAD9239843407FBBA15A927B031A0B9FD4B2CB2D1EE18D53DD724
                                                            Function 0048001D Relevance: .3, Instructions: 323COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                            • Instruction ID: 209de7055070552db81848e436bd5b13a76ca752a19b1674c3b58a281d5b6b1f
                                                            • Opcode Fuzzy Hash: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
                                                            • Instruction Fuzzy Hash: 23B1B8321151624BEFAD5239843403FBBA15A933B031A1B9FD4B2CB2C5EE28957DD724
                                                            Function 00482E47 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: dcc17a7b945fdd7ff58f89c8d2c4b6e9ed541ceabc3ad9498ff493ed1c439512
                                                            • Instruction ID: 72d503e21bf223ed940b26c49544666a9a974f3a670aaa32c8503f4306dc2ba3
                                                            • Opcode Fuzzy Hash: dcc17a7b945fdd7ff58f89c8d2c4b6e9ed541ceabc3ad9498ff493ed1c439512
                                                            • Instruction Fuzzy Hash: D561597160020866DB39B9288A55BBF63A4AB51B04F500D1BEB43DF381D7DD9E82D31E
                                                            Function 0045CDBD Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 366COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,0049CA9C,?,00000000), ref: 0045CEF3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateCompareProcessString
                                                            • String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$payload.cpp$version.dll$wininet.dll
                                                            • API String ID: 1171520630-1949177747
                                                            • Opcode ID: 869f78712ecbb95418d01cbb61b05e9e1b5978eb3fe654c34297b14f5acb490d
                                                            • Instruction ID: 352d5dc82723c5ae0c7c9b5f46683720186529f3684761c1ee82f7cb57934e31
                                                            • Opcode Fuzzy Hash: 869f78712ecbb95418d01cbb61b05e9e1b5978eb3fe654c34297b14f5acb490d
                                                            • Instruction Fuzzy Hash: A3C1A372D40625BBCF219E94CC41F6E7A64AF04722F2002B7FD01B6292D76CEE49979D
                                                            Function 0045FF99 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 484registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 00460592
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close
                                                            • String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.1.2318$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
                                                            • API String ID: 3535843008-2755343042
                                                            • Opcode ID: f7cd9e5fe69923d316b069d774f80a5f03a351a16c3d461c696d2a36ba348a89
                                                            • Instruction ID: 679e542dfe75c1804812516349301e5df6bf70f29a02af1dc46353e7affaf1fb
                                                            • Opcode Fuzzy Hash: f7cd9e5fe69923d316b069d774f80a5f03a351a16c3d461c696d2a36ba348a89
                                                            • Instruction Fuzzy Hash: CFF1D031A41626BBCF229660CD02FAF7A64AB24714F140167FD0176261F77DED60EACE
                                                            Function 00458476 Relevance: 61.6, APIs: 5, Strings: 30, Instructions: 331COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?,?,00000000,80070490,?,?,?,?,?,?,?,ETE,0047C1BF,?,?,?), ref: 004584A7
                                                            • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,ETE,0047C1BF,?,?,?,?,ETE,Chain), ref: 00458804
                                                            Strings
                                                            • Failed to get next node., xrefs: 004587F6
                                                            • Failed to get @Type., xrefs: 00458788
                                                            • ETE, xrefs: 00458476
                                                            • Attempt to set built-in variable value: %ls, xrefs: 004587C8
                                                            • Failed to select variable nodes., xrefs: 004584C4
                                                            • Hidden, xrefs: 0045852F
                                                            • version, xrefs: 0045862C
                                                            • Variable, xrefs: 004584B1
                                                            • Value, xrefs: 00458565
                                                            • Initializing hidden variable '%ls', xrefs: 00458671
                                                            • Failed to find variable value '%ls'., xrefs: 004587D2
                                                            • numeric, xrefs: 004585BC
                                                            • Failed to get @Id., xrefs: 004587EF
                                                            • Failed to get @Value., xrefs: 00458796
                                                            • Initializing numeric variable '%ls' to value '%ls', xrefs: 004585E2
                                                            • Failed to insert variable '%ls'., xrefs: 004586C6
                                                            • Failed to set value of variable: %ls, xrefs: 004587A7
                                                            • Persisted, xrefs: 0045854A
                                                            • Initializing string variable '%ls' to value '%ls', xrefs: 0045861A
                                                            • Failed to get @Hidden., xrefs: 004587E8
                                                            • Failed to get @Persisted., xrefs: 004587E1
                                                            • Invalid value for @Type: %ls, xrefs: 00458778
                                                            • Failed to change variant type., xrefs: 004587DA
                                                            • Type, xrefs: 004585A3
                                                            • Initializing version variable '%ls' to value '%ls', xrefs: 00458653
                                                            • Failed to set variant encryption, xrefs: 0045879D
                                                            • Failed to get variable node count., xrefs: 004584E1
                                                            • string, xrefs: 004585F7
                                                            • variable.cpp, xrefs: 004587B9
                                                            • Failed to set variant value., xrefs: 0045878F
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Attempt to set built-in variable value: %ls$ETE$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
                                                            • API String ID: 3168844106-3924381701
                                                            • Opcode ID: f772dcb438133d09aa9b57ce4efde1cf30c464b80be4eda598ac4cfa4127d40e
                                                            • Instruction ID: a4aa93820add616a1bea0ba12f8db0bd8314af3831bac2759f9d8a5dc42ffc2a
                                                            • Opcode Fuzzy Hash: f772dcb438133d09aa9b57ce4efde1cf30c464b80be4eda598ac4cfa4127d40e
                                                            • Instruction Fuzzy Hash: 5BB1B432D40219BBCF11DB95CC85EAEBE74AF04711F20026BF914B6252DF789A44DB9D
                                                            Function 00476CCC Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 379COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,0046BDDC,00000007,?,?,?), ref: 00476D20
                                                              • Part of subcall function 00490ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00455EB2,00000000), ref: 00490AE0
                                                              • Part of subcall function 00490ACC: GetProcAddress.KERNEL32(00000000), ref: 00490AE7
                                                              • Part of subcall function 00490ACC: GetLastError.KERNEL32(?,?,?,00455EB2,00000000), ref: 00490AFE
                                                            • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 0047710F
                                                            • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00477123
                                                            Strings
                                                            • "%ls" "%ls" /quiet /norestart, xrefs: 00476E48
                                                            • Failed to format MSU install command., xrefs: 00476E5C
                                                            • /log:, xrefs: 00476EA2
                                                            • D, xrefs: 00476F3B
                                                            • msuengine.cpp, xrefs: 00476F8D, 00477022, 0047704A
                                                            • Failed to wait for executable to complete: %ls, xrefs: 0047709E
                                                            • Failed to allocate WUSA.exe path., xrefs: 00476DB3
                                                            • Failed to append log path to MSU command-line., xrefs: 00476ED4
                                                            • Failed to get process exit code., xrefs: 0047702C
                                                            • Failed to append SysNative directory., xrefs: 00476D7D
                                                            • WixBundleExecutePackageCacheFolder, xrefs: 00476E0B, 0047713B
                                                            • "%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00476E75
                                                            • Bootstrapper application aborted during MSU progress., xrefs: 00477054
                                                            • 2, xrefs: 00476FB3
                                                            • Failed to CreateProcess on path: %ls, xrefs: 00476F9A
                                                            • Failed to append log switch to MSU command-line., xrefs: 00476EB6
                                                            • Failed to ensure WU service was enabled to install MSU package., xrefs: 00476F2E
                                                            • SysNative\, xrefs: 00476D6A
                                                            • Failed to find System32 directory., xrefs: 00476D95
                                                            • Failed to get action arguments for MSU package., xrefs: 00476DD6
                                                            • Failed to find Windows directory., xrefs: 00476D5F
                                                            • Failed to get cached path for package: %ls, xrefs: 00476DFC
                                                            • Failed to format MSU uninstall command., xrefs: 00476E89
                                                            • Failed to build MSU path., xrefs: 00476E35
                                                            • Failed to determine WOW64 status., xrefs: 00476D32
                                                            • wusa.exe, xrefs: 00476DA0
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
                                                            • String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
                                                            • API String ID: 1400713077-4261965642
                                                            • Opcode ID: 98349882e387841cf52a70c07f7bef575aee078abcafb4a9251d772192d86379
                                                            • Instruction ID: b717a641311a0c946fb98f91af058744cf995aa28ad832ee4c4292af8148398d
                                                            • Opcode Fuzzy Hash: 98349882e387841cf52a70c07f7bef575aee078abcafb4a9251d772192d86379
                                                            • Instruction Fuzzy Hash: A8D1C170A4070AEBDF219FA5CC85BEF7BB9AF14304F50803BF608A2251D7BC99449B59
                                                            Function 004654DC Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 229filepipesleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(?,?,00000000,?,0049B500,?,00000000,?,0045452F,?,0049B500), ref: 004654FD
                                                            • GetCurrentProcessId.KERNEL32(?,0045452F,?,0049B500), ref: 00465508
                                                            • SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0045452F,?,0049B500), ref: 0046553F
                                                            • ConnectNamedPipe.KERNEL32(?,00000000,?,0045452F,?,0049B500), ref: 00465554
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 0046555E
                                                            • Sleep.KERNEL32(00000064,?,0045452F,?,0049B500), ref: 00465593
                                                            • SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0045452F,?,0049B500), ref: 004655B6
                                                            • WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0045452F,?,0049B500), ref: 004655D1
                                                            • WriteFile.KERNEL32(?,/EE,0049B500,00000000,00000000,?,0045452F,?,0049B500), ref: 004655EC
                                                            • WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0045452F,?,0049B500), ref: 00465607
                                                            • ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,0045452F,?,0049B500), ref: 00465622
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 0046567D
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 004656B1
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 004656E5
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 00465719
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 0046574A
                                                            • GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 0046577B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
                                                            • String ID: /EE$Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$comres.dll$crypt32.dll$feclient.dll$pipe.cpp$wininet.dll
                                                            • API String ID: 2944378912-55498568
                                                            • Opcode ID: 4a9d511ef9c6913d97dd55c1ea0b189edd93ce0a7977d3fae6f7f215341a531b
                                                            • Instruction ID: 692d654e9d3f8e4f4d0dd42ba4a34115934ef02e4fc903aebce7ff892ea69315
                                                            • Opcode Fuzzy Hash: 4a9d511ef9c6913d97dd55c1ea0b189edd93ce0a7977d3fae6f7f215341a531b
                                                            • Instruction Fuzzy Hash: 3B710876D41735BBD7209BA58C49BAE66A8AF14B51F210037FD04FB281F76C9D0086EE
                                                            Function 0047D43E Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 290synchronizationprocessCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • UuidCreate.RPCRT4(?), ref: 0047D4B3
                                                            • StringFromGUID2.OLE32(?,?,00000027), ref: 0047D4DC
                                                            • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 0047D5C5
                                                            • GetLastError.KERNEL32(?,?,?,?), ref: 0047D5CF
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 0047D668
                                                            • WaitForSingleObject.KERNEL32(0049B500,000000FF,?,?,?,?), ref: 0047D673
                                                            • ReleaseMutex.KERNEL32(0049B500,?,?,?,?), ref: 0047D69D
                                                            • GetExitCodeProcess.KERNEL32(?,?), ref: 0047D6BE
                                                            • GetLastError.KERNEL32(?,?,?,?), ref: 0047D6CC
                                                            • GetLastError.KERNEL32(?,?,?,?), ref: 0047D704
                                                              • Part of subcall function 0047D33E: WaitForSingleObject.KERNEL32(?,000000FF,774D30B0,00000000,?,?,?,?,0047D642,?), ref: 0047D357
                                                              • Part of subcall function 0047D33E: ReleaseMutex.KERNEL32(?,?,?,?,0047D642,?), ref: 0047D375
                                                              • Part of subcall function 0047D33E: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0047D3B6
                                                              • Part of subcall function 0047D33E: ReleaseMutex.KERNEL32(?), ref: 0047D3CD
                                                              • Part of subcall function 0047D33E: SetEvent.KERNEL32(?), ref: 0047D3D6
                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 0047D7B9
                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 0047D7D1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
                                                            • String ID: %ls /pipe %ls$D$D$G$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
                                                            • API String ID: 1533322865-3347467665
                                                            • Opcode ID: f5bad49f4527fa9d3012e43fedec2e18a22cd4c46967fa4d4acf463dcec0a2ef
                                                            • Instruction ID: d43dd97caf6accf6e17c15638e0858a844184176b01c119f2630e861758b33e2
                                                            • Opcode Fuzzy Hash: f5bad49f4527fa9d3012e43fedec2e18a22cd4c46967fa4d4acf463dcec0a2ef
                                                            • Instruction Fuzzy Hash: 10A1A372D50228ABDB219FA4CD45BDEB7B8AF04711F20816BE90CF7251D7389D448FA9
                                                            Function 0049744A Relevance: 45.8, APIs: 13, Strings: 13, Instructions: 340COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 0049755D
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497726
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004977C3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$FreeHeap$AllocateCompareProcess
                                                            • String ID: ($@$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
                                                            • API String ID: 1555028553-2592408802
                                                            • Opcode ID: f7be0a4bd61173076840755cb5820a6ca878d839bd6c39a0d3fbe9a3c2d43103
                                                            • Instruction ID: 08259d399335e7b255ed1e0f652fe653a1172f2dab21e2dc100f9d8ab948b8c4
                                                            • Opcode Fuzzy Hash: f7be0a4bd61173076840755cb5820a6ca878d839bd6c39a0d3fbe9a3c2d43103
                                                            • Instruction Fuzzy Hash: 79B16435958226BBDF119B94CC41FAE7B74AB04730F2103A6F521A62D1D778FD10DBA8
                                                            Function 0049710D Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 298COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,004B3E78,000000FF,?,?,?), ref: 004971D4
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 004971F9
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00497219
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00497235
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 0049725D
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00497279
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 004972B2
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 004972EB
                                                              • Part of subcall function 00496D50: SysFreeString.OLEAUT32(00000000), ref: 00496E89
                                                              • Part of subcall function 00496D50: SysFreeString.OLEAUT32(00000000), ref: 00496EC8
                                                            • SysFreeString.OLEAUT32(00000000), ref: 0049736F
                                                            • SysFreeString.OLEAUT32(00000000), ref: 0049741F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$Compare$Free
                                                            • String ID: ($atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
                                                            • API String ID: 318886736-4294603148
                                                            • Opcode ID: 23b9c77fc0d87c440a65c04a927cb3b03f0f86f12eeccb448b64c81ada2c48bf
                                                            • Instruction ID: 89668433a3dc1ffccdf4e5b689ec6f7c2d2a643de6dc02eb884eae4bc8c10bc9
                                                            • Opcode Fuzzy Hash: 23b9c77fc0d87c440a65c04a927cb3b03f0f86f12eeccb448b64c81ada2c48bf
                                                            • Instruction Fuzzy Hash: 6AA18431958226FBDF219B64CC41FAE7F74AB04760F204376F924AA2D1D778EA00D799
                                                            Function 0045A416 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045A45A
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045A480
                                                            • RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 0045A768
                                                            Strings
                                                            • Registry key not found. Key = '%ls', xrefs: 0045A4B4
                                                            • search.cpp, xrefs: 0045A54A, 0045A57D, 0045A5D0, 0045A6D3
                                                            • Failed to allocate string buffer., xrefs: 0045A667
                                                            • Failed to read registry value., xrefs: 0045A6F6
                                                            • Failed to query registry key value size., xrefs: 0045A554
                                                            • Failed to open registry key., xrefs: 0045A4ED
                                                            • Failed to get expand environment string., xrefs: 0045A6DD
                                                            • Failed to change value type., xrefs: 0045A70F
                                                            • RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0045A740
                                                            • Failed to set variable., xrefs: 0045A72B
                                                            • Unsupported registry key value type. Type = '%u', xrefs: 0045A608
                                                            • Failed to allocate memory registry value., xrefs: 0045A587
                                                            • Failed to query registry key value., xrefs: 0045A5DA
                                                            • Failed to clear variable., xrefs: 0045A4D8
                                                            • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0045A51C
                                                            • Failed to format value string., xrefs: 0045A48B
                                                            • Failed to format key string., xrefs: 0045A465
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16$Close
                                                            • String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
                                                            • API String ID: 2348241696-3124384294
                                                            • Opcode ID: 2e8cc5d4b5bbcf6d02786ca89b8285db4ada514f4e5f085614ad7a5f771a1fab
                                                            • Instruction ID: 1828939321c0dffcdf203ed5787a818fe600ac48c3f0840644ce784b7e7c824b
                                                            • Opcode Fuzzy Hash: 2e8cc5d4b5bbcf6d02786ca89b8285db4ada514f4e5f085614ad7a5f771a1fab
                                                            • Instruction Fuzzy Hash: C2A10672C00129BBCF119AE5CC45EAE7A74AF08712F148237FD00B6252D739DD289A9E
                                                            Function 00455770 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 479stringCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000000,00000000,?,0045A8B4,00000100,000002C0,000002C0,00000100), ref: 00455795
                                                            • lstrlenW.KERNEL32(000002C0,?,0045A8B4,00000100,000002C0,000002C0,00000100), ref: 0045579F
                                                            • _wcschr.LIBVCRUNTIME ref: 004559A7
                                                            • LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,0045A8B4,00000100,000002C0,000002C0,00000100), ref: 00455C4A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave_wcschrlstrlen
                                                            • String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
                                                            • API String ID: 1026845265-2050445661
                                                            • Opcode ID: 7d8f239a5ae624eb60c80f689a826b1d2a773c5f927ec0bae70d7d46f13f7628
                                                            • Instruction ID: 8d40205c8eb16b7dbfbc9f05f9628341b632801ca436fe749d5ed68fe23856b6
                                                            • Opcode Fuzzy Hash: 7d8f239a5ae624eb60c80f689a826b1d2a773c5f927ec0bae70d7d46f13f7628
                                                            • Instruction Fuzzy Hash: 84F1B371D00615FBCF11DFA58851ABF7BA4EB04B66F11412BFC05AB242D73C9E058BA9
                                                            Function 0047CE81 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 240synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,0047D558,?,?,?), ref: 0047CEC7
                                                            • GetLastError.KERNEL32(?,?,0047D558,?,?,?), ref: 0047CED4
                                                            • ReleaseMutex.KERNEL32(?), ref: 0047D13C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
                                                            • String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
                                                            • API String ID: 3944734951-2991465304
                                                            • Opcode ID: 897b0794673511b4317fa4fb76a6ef2ad51b594d9c301a6c3d0699d10ca5e993
                                                            • Instruction ID: 56cebbc84d115d2814ed90abcacfec577c88d87b1496693910845a29d5766ce7
                                                            • Opcode Fuzzy Hash: 897b0794673511b4317fa4fb76a6ef2ad51b594d9c301a6c3d0699d10ca5e993
                                                            • Instruction Fuzzy Hash: C681F476A41322BBC7219B658C49FDB7AA4EF04761F11816BFD08AB351D738DD008AEC
                                                            Function 0045EA42 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 004932F3: VariantInit.OLEAUT32(?), ref: 00493309
                                                              • Part of subcall function 004932F3: SysAllocString.OLEAUT32(?), ref: 00493325
                                                              • Part of subcall function 004932F3: VariantClear.OLEAUT32(?), ref: 004933AC
                                                              • Part of subcall function 004932F3: SysFreeString.OLEAUT32(00000000), ref: 004933B7
                                                            • CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,0049CA9C,?,?,Action,?,?,?,00000000,?), ref: 0045EB13
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 0045EB5D
                                                            Strings
                                                            • Failed to resize Addon code array in registration, xrefs: 0045EC3C
                                                            • Failed to get RelatedBundle element count., xrefs: 0045EA97
                                                            • Failed to resize Upgrade code array in registration, xrefs: 0045EC35
                                                            • Invalid value for @Action: %ls, xrefs: 0045EC52
                                                            • Addon, xrefs: 0045EB9A
                                                            • comres.dll, xrefs: 0045EB26
                                                            • Failed to resize Patch code array in registration, xrefs: 0045EC43
                                                            • Patch, xrefs: 0045EBDD
                                                            • Failed to get next RelatedBundle element., xrefs: 0045EC70
                                                            • Detect, xrefs: 0045EB04
                                                            • version.dll, xrefs: 0045EB70
                                                            • Upgrade, xrefs: 0045EB50
                                                            • cabinet.dll, xrefs: 0045EBBA
                                                            • Failed to resize Detect code array in registration, xrefs: 0045EC2E
                                                            • Action, xrefs: 0045EAD0
                                                            • RelatedBundle, xrefs: 0045EA50
                                                            • Failed to get @Id., xrefs: 0045EC62
                                                            • Failed to get @Action., xrefs: 0045EC69
                                                            • Failed to get RelatedBundle nodes, xrefs: 0045EA72
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$CompareVariant$AllocClearFreeInit
                                                            • String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
                                                            • API String ID: 702752599-259800149
                                                            • Opcode ID: 27db61466c5c898a7e4b69a2eba3482ca010b462c49a0c53e8b930a2cd4f8637
                                                            • Instruction ID: 0348f1cb908e88f607e69ba9faef5a36d4a704a4e858c0aa2c0b7d77b880df03
                                                            • Opcode Fuzzy Hash: 27db61466c5c898a7e4b69a2eba3482ca010b462c49a0c53e8b930a2cd4f8637
                                                            • Instruction Fuzzy Hash: 0C71C371904216BBCB19CF65C941EAEBBB4FB05726F20025AFD11672D2D738EE05CB98
                                                            Function 004646DC Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 185fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00464BF5,0049B4E8,?,feclient.dll,00000000,?,?), ref: 004646F3
                                                            • ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00464BF5,0049B4E8,?,feclient.dll,00000000,?,?), ref: 00464714
                                                            • GetLastError.KERNEL32(?,00464BF5,0049B4E8,?,feclient.dll,00000000,?,?), ref: 0046471A
                                                            • ReadFile.KERNEL32(feclient.dll,00000000,0049B518,?,00000000,00000000,0049B519,?,00464BF5,0049B4E8,?,feclient.dll,00000000,?,?), ref: 004647A8
                                                            • GetLastError.KERNEL32(?,00464BF5,0049B4E8,?,feclient.dll,00000000,?,?), ref: 004647AE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastRead$CurrentProcess
                                                            • String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
                                                            • API String ID: 1233551569-452622383
                                                            • Opcode ID: ffa98bad437e9e7fe3f1c26e88baf6109148fd6536553b9cadfe2831b9e6ef2d
                                                            • Instruction ID: 81b3b702b18041b3ce45e9597505235de1950a0cf4e08d344231b3040fe3d826
                                                            • Opcode Fuzzy Hash: ffa98bad437e9e7fe3f1c26e88baf6109148fd6536553b9cadfe2831b9e6ef2d
                                                            • Instruction Fuzzy Hash: 43510C76D40225B7DF11AB955C46F6F7668AB92B11F21013BFD00BB280E37C9D0086EE
                                                            Function 004727FC Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: StringVariant$AllocClearFreeInit
                                                            • String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
                                                            • API String ID: 760788290-1911311241
                                                            • Opcode ID: 577719f59994cdd29346d70279e0933b8f8b11e35475ab3bf63e43a33ba914cd
                                                            • Instruction ID: 2605c5c87a2cb9dbae1357aa6b8377dc438397ca0daa632445200ba00f2bf6ca
                                                            • Opcode Fuzzy Hash: 577719f59994cdd29346d70279e0933b8f8b11e35475ab3bf63e43a33ba914cd
                                                            • Instruction Fuzzy Hash: D741EDF1B88722B6CA2155648D02FEB76589B22730F354367FA28762C1D7EC9D00D6DE
                                                            Function 00458F72 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetStringTypeW.KERNEL32(00000001,560049DB,00000001,?,00459946,?,00000000,00000000,?,?,0045992E,?,?,00000000,?), ref: 00458FB2
                                                            Strings
                                                            • AND, xrefs: 004592BC
                                                            • Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 004591DE
                                                            • Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00459242
                                                            • Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00459162
                                                            • Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00459380
                                                            • condition.cpp, xrefs: 00459084, 0045914E, 004591CA, 0045922E, 0045936C, 004593B0, 004593F4
                                                            • -, xrefs: 00459118
                                                            • Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00459098
                                                            • Failed to set symbol value., xrefs: 00459060
                                                            • Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 004593C4
                                                            • Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00459408
                                                            • NOT, xrefs: 004592DB
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: StringType
                                                            • String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
                                                            • API String ID: 4177115715-3594736606
                                                            • Opcode ID: b45750d2f391fe6e0cf4e3fb0a80f402a08c365a245ae92c41a9bb0c8012192c
                                                            • Instruction ID: 6aefcee4c43c8fe884e0c058de664dee992619e680db176ccb6946e98bd39539
                                                            • Opcode Fuzzy Hash: b45750d2f391fe6e0cf4e3fb0a80f402a08c365a245ae92c41a9bb0c8012192c
                                                            • Instruction Fuzzy Hash: 67F10271904301FBDB24CF54C889BAA7BA4FB05705F20455BFD059A286C3BDDE9ACB89
                                                            Function 00466BCA Relevance: 35.4, APIs: 6, Strings: 14, Instructions: 351synchronizationthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045D4A8: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00467040,000000B8,00000000,?,00000000,7707B390), ref: 0045D4B7
                                                              • Part of subcall function 0045D4A8: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0045D4C6
                                                              • Part of subcall function 0045D4A8: LeaveCriticalSection.KERNEL32(000000D0,?,00467040,000000B8,00000000,?,00000000,7707B390), ref: 0045D4DB
                                                            • CreateThread.KERNEL32(00000000,00000000,004657BD,?,00000000,00000000), ref: 00466E34
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00454522,?,0049B500,?,00454846,?,?), ref: 00466E43
                                                            • CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00454522,?,0049B500,?,00454846,?,?), ref: 00466EA0
                                                            • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00466F92
                                                            • CloseHandle.KERNEL32(00000000), ref: 00466F9B
                                                            • CloseHandle.KERNEL32(crypt32.dll,?,00000000,?,00000000,00000001,00000000), ref: 00466FB5
                                                              • Part of subcall function 0047BD05: SetThreadExecutionState.KERNEL32(80000001), ref: 0047BD0A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$CriticalSectionThread$CompareCreateEnterErrorExchangeExecutionInterlockedLastLeaveMutexReleaseState
                                                            • String ID: "EE$Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$FHE$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
                                                            • API String ID: 2169948125-1347930456
                                                            • Opcode ID: de5e0ad75f1dc3245ca741e9872f5e2f92c6155455007329801e96bd58032947
                                                            • Instruction ID: dbd475d51afd78a7a8ec0c8da45248ecbadf2eec88bf2caf77be6d0db216e022
                                                            • Opcode Fuzzy Hash: de5e0ad75f1dc3245ca741e9872f5e2f92c6155455007329801e96bd58032947
                                                            • Instruction Fuzzy Hash: 8DC10571900215ABDF159F50D885BEF36B8EF04705F11417BFD08AE242EB789941CBAE
                                                            Function 00471BB1 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00471CB8
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00471CD6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareHeapString$AllocateProcess
                                                            • String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
                                                            • API String ID: 2664528157-1714101571
                                                            • Opcode ID: 132beea78d86155de8d7357609cbd6b00b43b3f974d8a365861bff966ddc8691
                                                            • Instruction ID: 174d7efd0959281897ca5989bb2b0608946016c3c1d84987c42836c175948dba
                                                            • Opcode Fuzzy Hash: 132beea78d86155de8d7357609cbd6b00b43b3f974d8a365861bff966ddc8691
                                                            • Instruction Fuzzy Hash: CD61D870944215BBCB209F99CC41EEE7BA5EF11720F308257F418AB2E1D778AD01CB99
                                                            Function 00498134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00498161
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 0049817C
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 0049821F
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,0049B518,00000000), ref: 0049825E
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 004982B1
                                                            • CompareStringW.KERNEL32(0000007F,00000000,0049B518,000000FF,true,000000FF), ref: 004982CF
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00498307
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 0049844B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
                                                            • API String ID: 1825529933-3037633208
                                                            • Opcode ID: 41ecd19ad16adf376dc825c56716dc9baf946207c7027450cea011004f24c5ab
                                                            • Instruction ID: 3540ec0a4055f6bf8134357719b237ff3f96e435960001b7c4027ea8169034a6
                                                            • Opcode Fuzzy Hash: 41ecd19ad16adf376dc825c56716dc9baf946207c7027450cea011004f24c5ab
                                                            • Instruction Fuzzy Hash: 53B1A131504602ABCF208F58CD85F5A7BA6AF45730F21467EF965EB2D2DB78E841CB18
                                                            Function 004977F7 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 206COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00497857
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 0049787C
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 0049789C
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 004978CF
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 004978EB
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497916
                                                            • SysFreeString.OLEAUT32(00000000), ref: 0049798D
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004979D9
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$Compare$Free
                                                            • String ID: comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
                                                            • API String ID: 318886736-3944986760
                                                            • Opcode ID: 542df8d379c515307595e90e363697a41e763acea7bd51153b752f0c5f161cc7
                                                            • Instruction ID: 3956954613958039592d31d2c128caacad6927ad237244941280d15ca09b44a2
                                                            • Opcode Fuzzy Hash: 542df8d379c515307595e90e363697a41e763acea7bd51153b752f0c5f161cc7
                                                            • Instruction Fuzzy Hash: CF615171918219BBDF11DB94CC45FAEBFB8EF05320F204276E521A7290D7389E00DB94
                                                            Function 00479DE1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 233threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,0047BC85,00000001), ref: 00479E46
                                                            • GetLastError.KERNEL32(?,0047BC85,00000001), ref: 00479FB6
                                                            • GetExitCodeThread.KERNEL32(00000001,00000000,?,0047BC85,00000001), ref: 00479FF6
                                                            • GetLastError.KERNEL32(?,0047BC85,00000001), ref: 0047A000
                                                            Strings
                                                            • Failed to execute dependency action., xrefs: 00479F36
                                                            • Invalid execute action., xrefs: 0047A056
                                                            • Failed to execute EXE package., xrefs: 00479E7D
                                                            • Failed to execute compatible package action., xrefs: 00479F73
                                                            • Failed to execute MSP package., xrefs: 00479ECB
                                                            • Failed to wait for cache check-point., xrefs: 00479FE7
                                                            • Failed to execute MSU package., xrefs: 00479EFB
                                                            • Failed to execute package provider registration action., xrefs: 00479F17
                                                            • Failed to execute MSI package., xrefs: 00479EA6
                                                            • Cache thread exited unexpectedly., xrefs: 0047A047
                                                            • apply.cpp, xrefs: 00479FDD, 0047A027
                                                            • Failed to load compatible package on per-machine package., xrefs: 00479F5C
                                                            • Failed to get cache thread exit code., xrefs: 0047A031
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
                                                            • String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
                                                            • API String ID: 3703294532-2662572847
                                                            • Opcode ID: c652c81de0f6467f4a245cbc9fffc3aa40039c347b64e91599fd37f0b180c78e
                                                            • Instruction ID: fc10ec076261e6fb09dd7ca60d61856004725f50f56bf9af24897a3519bd4ed4
                                                            • Opcode Fuzzy Hash: c652c81de0f6467f4a245cbc9fffc3aa40039c347b64e91599fd37f0b180c78e
                                                            • Instruction Fuzzy Hash: 6D717171A01255EFDB10DFA5C941EEF77B8EB45710F20816BF808E7240D3399E019BA9
                                                            Function 0045F210 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 183registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00493AF1: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 00493B3E
                                                            • RegCloseKey.ADVAPI32(00000000,?,004A0D10,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 0045F440
                                                              • Part of subcall function 004914A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,0045F28D,004A0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 004914BB
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseValueVersion
                                                            • String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$registration.cpp
                                                            • API String ID: 2348918689-2631711097
                                                            • Opcode ID: 477412c9db170f340fd18b0c7cbfa84261a346facd449aea464e414d98e01a21
                                                            • Instruction ID: 1a51f967c7d319c9b5f2b450b4fa84bde377cffcf733409d14697b3f01dee705
                                                            • Opcode Fuzzy Hash: 477412c9db170f340fd18b0c7cbfa84261a346facd449aea464e414d98e01a21
                                                            • Instruction Fuzzy Hash: 7251E632D40226BBDF119EE18C06BAF7A64AB11726F10013BFD00B6262D77D991C97CE
                                                            Function 0047CC91 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 174processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcessId.KERNEL32(774C8FB0,00000002,00000000), ref: 0047CC9D
                                                              • Part of subcall function 00464D8D: UuidCreate.RPCRT4(?), ref: 00464DC0
                                                            • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,00472401,?,?,00000000,?,?,?), ref: 0047CD7B
                                                            • GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 0047CD85
                                                            • GetProcessId.KERNEL32(00472401,?,?,00000000,?,?,?,?), ref: 0047CDBD
                                                              • Part of subcall function 004654DC: lstrlenW.KERNEL32(?,?,00000000,?,0049B500,?,00000000,?,0045452F,?,0049B500), ref: 004654FD
                                                              • Part of subcall function 004654DC: GetCurrentProcessId.KERNEL32(?,0045452F,?,0049B500), ref: 00465508
                                                              • Part of subcall function 004654DC: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0045452F,?,0049B500), ref: 0046553F
                                                              • Part of subcall function 004654DC: ConnectNamedPipe.KERNEL32(?,00000000,?,0045452F,?,0049B500), ref: 00465554
                                                              • Part of subcall function 004654DC: GetLastError.KERNEL32(?,0045452F,?,0049B500), ref: 0046555E
                                                              • Part of subcall function 004654DC: Sleep.KERNEL32(00000064,?,0045452F,?,0049B500), ref: 00465593
                                                              • Part of subcall function 004654DC: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0045452F,?,0049B500), ref: 004655B6
                                                              • Part of subcall function 004654DC: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0045452F,?,0049B500), ref: 004655D1
                                                              • Part of subcall function 004654DC: WriteFile.KERNEL32(?,/EE,0049B500,00000000,00000000,?,0045452F,?,0049B500), ref: 004655EC
                                                              • Part of subcall function 004654DC: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0045452F,?,0049B500), ref: 00465607
                                                              • Part of subcall function 00490A28: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00454F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00490A38
                                                              • Part of subcall function 00490A28: GetLastError.KERNEL32(?,?,00454F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00490A46
                                                            • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0047CBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 0047CE41
                                                            • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0047CBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 0047CE50
                                                            • CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,0047CBEF,?,?,?,?,?,00000000,?,?,?), ref: 0047CE67
                                                            Strings
                                                            • %ls -%ls %ls %ls %u, xrefs: 0047CD40
                                                            • embedded.cpp, xrefs: 0047CDA6
                                                            • burn.embedded, xrefs: 0047CD38
                                                            • Failed to create embedded process at path: %ls, xrefs: 0047CDB3
                                                            • Failed to create embedded pipe., xrefs: 0047CD27
                                                            • Failed to allocate embedded command., xrefs: 0047CD54
                                                            • Failed to wait for embedded process to connect to pipe., xrefs: 0047CDDF
                                                            • Failed to process messages from embedded message., xrefs: 0047CE04
                                                            • Failed to create embedded pipe name and client token., xrefs: 0047CD00
                                                            • Failed to wait for embedded executable: %ls, xrefs: 0047CE24
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
                                                            • String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
                                                            • API String ID: 875070380-3803182736
                                                            • Opcode ID: 0d0dc1d90fc181d3074a8555c01344a1f995eab2ed13ba560f40506fecfa5c77
                                                            • Instruction ID: ddca6a6e6feae42f4c2bcec1e1e199bb660f54a537cd1421f6b1beb0c283d6f5
                                                            • Opcode Fuzzy Hash: 0d0dc1d90fc181d3074a8555c01344a1f995eab2ed13ba560f40506fecfa5c77
                                                            • Instruction Fuzzy Hash: DF518072D4022DBBDF219B94DC46BDF7BB8AF04711F10412BFA04B6290E7789A448BD9
                                                            Function 00497F7E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00498468,00000001,?), ref: 00497F9E
                                                            • CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00498468,00000001,?), ref: 00497FB9
                                                            • CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00498468,00000001,?), ref: 00497FD4
                                                            • CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00498468,00000001,?), ref: 00498040
                                                            • CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00498468,00000001,?), ref: 00498064
                                                            • CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00498468,00000001,?), ref: 00498088
                                                            • CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00498468,00000001,?), ref: 004980A8
                                                            • lstrlenW.KERNEL32(006C0064,?,00498468,00000001,?), ref: 004980C3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString$lstrlen
                                                            • String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
                                                            • API String ID: 1657112622-2492263259
                                                            • Opcode ID: 6b11b06097c3e6bfc8cb17fdab466105bc21a15a93235b2dabeea3ce9fe13f54
                                                            • Instruction ID: a6dc02aabdbb66d7cd9105d05b599a36117cac11210871a50e02bb405c4597b7
                                                            • Opcode Fuzzy Hash: 6b11b06097c3e6bfc8cb17fdab466105bc21a15a93235b2dabeea3ce9fe13f54
                                                            • Instruction Fuzzy Hash: A751A531648612BBDF204E58DC46F567E65EB12730F31432AF634AE2D5CBA9E8448798
                                                            Function 0045A03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045A0B6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16
                                                            • String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
                                                            • API String ID: 3613110473-2134270738
                                                            • Opcode ID: 6e088b1f674ac266e0f0294c35ccb9ec41dd4671a39403607ab97ce1ee15e541
                                                            • Instruction ID: 420fed82121456cfe73e62979723644b303522ecc69ebf7ae18653856426494d
                                                            • Opcode Fuzzy Hash: 6e088b1f674ac266e0f0294c35ccb9ec41dd4671a39403607ab97ce1ee15e541
                                                            • Instruction Fuzzy Hash: A961C532D40114BBCF11DE9ACD46E9F7F64AB04715F2042ABFD04BA352C23ADE25979A
                                                            Function 0045ECBE Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 173COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysFreeString.OLEAUT32(?), ref: 0045EE4C
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • SysFreeString.OLEAUT32(?), ref: 0045EE04
                                                            Strings
                                                            • Failed to get software tag count., xrefs: 0045ED13
                                                            • Failed to get next node., xrefs: 0045EEB3
                                                            • registration.cpp, xrefs: 0045ED41
                                                            • Failed to get @Filename., xrefs: 0045EEA9
                                                            • Failed to select software tag nodes., xrefs: 0045ECEE
                                                            • Failed to get SoftwareTag text., xrefs: 0045EE8B
                                                            • Failed to convert SoftwareTag text to UTF-8, xrefs: 0045EE81
                                                            • Failed to allocate memory for software tag structs., xrefs: 0045ED4B
                                                            • Regid, xrefs: 0045ED9A
                                                            • Failed to get @Regid., xrefs: 0045EE9F
                                                            • Failed to get @Path., xrefs: 0045EE95
                                                            • SoftwareTag, xrefs: 0045ECCD
                                                            • Path, xrefs: 0045EDB2
                                                            • Filename, xrefs: 0045ED7F
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeHeapString$AllocateProcess
                                                            • String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$registration.cpp
                                                            • API String ID: 336948655-1068704183
                                                            • Opcode ID: b736087072522a25ab8f2c443f34c4ace2115f7a2d3c15dad5d93e43e04ea1d6
                                                            • Instruction ID: 113e7465ae8275247cbd62a6993adaab36bdb9d3862ba571c6e3f219b3805470
                                                            • Opcode Fuzzy Hash: b736087072522a25ab8f2c443f34c4ace2115f7a2d3c15dad5d93e43e04ea1d6
                                                            • Instruction Fuzzy Hash: 9F519431A01325ABCB19DF56C882AAEBBA4BF05752F10416BFD01AB251C778DF048798
                                                            Function 00464B2A Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 158sleepfileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00464B84
                                                            • GetLastError.KERNEL32 ref: 00464B92
                                                            • Sleep.KERNEL32(00000064), ref: 00464BB6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateErrorFileLastSleep
                                                            • String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
                                                            • API String ID: 408151869-3212458075
                                                            • Opcode ID: 5ec35b4cf4785b2c67f53bc361dc57c118c0a0fc900917468f58af9fa31dd3b5
                                                            • Instruction ID: 69b7a2560e9964ebcf047b6123793abc745f25c2301ac0c881d229728424caf2
                                                            • Opcode Fuzzy Hash: 5ec35b4cf4785b2c67f53bc361dc57c118c0a0fc900917468f58af9fa31dd3b5
                                                            • Instruction Fuzzy Hash: 97411836D81631BBDF2156A1DD06F5E7A54AF91B20F220267FD00BA390E76CAD0096DE
                                                            Function 004769D2 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 153serviceCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00476F28,?), ref: 00476A0B
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00476F28,?,?,?), ref: 00476A18
                                                            • OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00476F28,?,?,?), ref: 00476A60
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00476F28,?,?,?), ref: 00476A6C
                                                            • QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00476F28,?,?,?), ref: 00476AA6
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00476F28,?,?,?), ref: 00476AB0
                                                            • CloseServiceHandle.ADVAPI32(00000000), ref: 00476B67
                                                            • CloseServiceHandle.ADVAPI32(?), ref: 00476B71
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
                                                            • String ID: (oG$Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
                                                            • API String ID: 971853308-3775435873
                                                            • Opcode ID: f3f099c5bc7d27c70b0ac7ac26dea077835d4348462bb8cca8583424edab4978
                                                            • Instruction ID: 5b0fe4a59c224944fc2ac9eabd31802b7d7d587ba99e393a4d1f036f1b195ebc
                                                            • Opcode Fuzzy Hash: f3f099c5bc7d27c70b0ac7ac26dea077835d4348462bb8cca8583424edab4978
                                                            • Instruction Fuzzy Hash: 1141F772E407255BD7219BA98D45AEFBAA5AB16710F12C03BFD09F7241D778DC0086E8
                                                            Function 0045F585 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(00000000,00000000,004604DF,InstallerVersion,InstallerVersion,00000000,004604DF,InstallerName,InstallerName,00000000,004604DF,Date,InstalledDate,00000000,004604DF,LogonUser), ref: 0045F733
                                                              • Part of subcall function 004914F4: RegSetValueExW.ADVAPI32(00020006,004A0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0045F335,00000000,?,00020006), ref: 00491527
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseValue
                                                            • String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
                                                            • API String ID: 3132538880-2703781546
                                                            • Opcode ID: 32652b22989ef6f9fcb859f66f58a10ac43f6e30d228520ed5a4692565b990dd
                                                            • Instruction ID: 3b622b87d8e462b7ed68998c7f09c3929f0abfeda530745662b682891ead528b
                                                            • Opcode Fuzzy Hash: 32652b22989ef6f9fcb859f66f58a10ac43f6e30d228520ed5a4692565b990dd
                                                            • Instruction Fuzzy Hash: DD41F531A80665B7CF1366558D02F9F7E249B25B16B200177FC00B6263D7AC9E0DA6CE
                                                            Function 0046E7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • TlsSetValue.KERNEL32(?,?), ref: 0046E7FF
                                                            • RegisterClassW.USER32(?), ref: 0046E82B
                                                            • GetLastError.KERNEL32 ref: 0046E836
                                                            • CreateWindowExW.USER32(00000080,004A9E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0046E89D
                                                            • GetLastError.KERNEL32 ref: 0046E8A7
                                                            • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0046E945
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                            • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                            • API String ID: 213125376-288575659
                                                            • Opcode ID: 5f3ca1515a4c7da722b7131f02f7346f5d8c12ae4d24706df3f3dc31b1f216ce
                                                            • Instruction ID: cc8f180eca2938c153e8db08a24c7939cdc56789ebf773c0dc5aa7847357af74
                                                            • Opcode Fuzzy Hash: 5f3ca1515a4c7da722b7131f02f7346f5d8c12ae4d24706df3f3dc31b1f216ce
                                                            • Instruction Fuzzy Hash: B9419476900215ABCB209BA6DD44BDEBFF8EF15750F204137F904AB250E7349D458BEA
                                                            Function 0047C774 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • Failed to copy download source for passthrough pseudo bundle., xrefs: 0047C98F
                                                            • Failed to copy local source path for passthrough pseudo bundle., xrefs: 0047C9B7
                                                            • pseudobundle.cpp, xrefs: 0047C7A8, 0047C9A1, 0047C9DB
                                                            • Failed to copy key for passthrough pseudo bundle., xrefs: 0047C988
                                                            • Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 0047C7B4
                                                            • Failed to copy cache id for passthrough pseudo bundle., xrefs: 0047CA05
                                                            • Failed to copy uninstall arguments for passthrough bundle package, xrefs: 0047CAAC
                                                            • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0047C9E7
                                                            • Failed to allocate memory for pseudo bundle payload hash., xrefs: 0047C9AD
                                                            • Failed to copy install arguments for passthrough bundle package, xrefs: 0047CA62
                                                            • Failed to recreate command-line arguments., xrefs: 0047CA43
                                                            • Failed to copy key for passthrough pseudo bundle payload., xrefs: 0047C9C5
                                                            • Failed to copy filename for passthrough pseudo bundle., xrefs: 0047C9BE
                                                            • Failed to copy related arguments for passthrough bundle package, xrefs: 0047CA82
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
                                                            • API String ID: 1357844191-115096447
                                                            • Opcode ID: 757749b2365d2b30bd81f359176b68a1e5c6e3a71f48843b5f5668115ecd2c45
                                                            • Instruction ID: 6038fd27e6fd47a9875be9806a20169c7f7d5333b2595ffdb32be6f13ac315b3
                                                            • Opcode Fuzzy Hash: 757749b2365d2b30bd81f359176b68a1e5c6e3a71f48843b5f5668115ecd2c45
                                                            • Instruction Fuzzy Hash: A1B19EB5600616EFCB51DF68C880F96BBE1BF08715F10816AFD089B352CB79E815DB98
                                                            Function 0047DE46 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 0047DE61
                                                            Strings
                                                            • Failed to complete BITS job., xrefs: 0047E00B
                                                            • Failed to set credentials for BITS job., xrefs: 0047DF0F
                                                            • Failed to add file to BITS job., xrefs: 0047DF2E
                                                            • Failed to create BITS job callback., xrefs: 0047DF74
                                                            • Failed to download BITS job., xrefs: 0047DFF8
                                                            • Failed to create BITS job., xrefs: 0047DEF0
                                                            • Failed to initialize BITS job callback., xrefs: 0047DF82
                                                            • Failed while waiting for BITS download., xrefs: 0047E012
                                                            • bitsengine.cpp, xrefs: 0047DE77, 0047DF6A
                                                            • Failed to copy download URL., xrefs: 0047DEA8
                                                            • Falied to start BITS job., xrefs: 0047E019
                                                            • Failed to set callback interface for BITS job., xrefs: 0047DF99
                                                            • Invalid BITS engine URL: %ls, xrefs: 0047DE83
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen
                                                            • String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
                                                            • API String ID: 1659193697-2382896028
                                                            • Opcode ID: 016ef0ccff524953e1368f4d8b03dc4c7238298ca1fc8e0623b035a60076e072
                                                            • Instruction ID: 0be26cabc6c1496625f9d387b6664e8c7ed7743a050f642097a39979bc702d70
                                                            • Opcode Fuzzy Hash: 016ef0ccff524953e1368f4d8b03dc4c7238298ca1fc8e0623b035a60076e072
                                                            • Instruction Fuzzy Hash: 8761E831D00225EBCB219F95C845EDE7BB4EF18710B21829BFC09AB251D7B9DD019B99
                                                            Function 00463B4E Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 130COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00463BA2
                                                            • GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00463BAC
                                                            • GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00463C15
                                                            • ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00463C1C
                                                            • CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00463CA6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
                                                            • String ID: 4Mw$%u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
                                                            • API String ID: 2407829081-2352143114
                                                            • Opcode ID: 4305761d33977bc3710347c7157a7cf636e6b499abc1b8e41a325440c0f35ce0
                                                            • Instruction ID: 7c30ea722af4fe453f23a27c6b68ad7f4c01a164382a143991bc075c5fa0d520
                                                            • Opcode Fuzzy Hash: 4305761d33977bc3710347c7157a7cf636e6b499abc1b8e41a325440c0f35ce0
                                                            • Instruction Fuzzy Hash: 3041AF72D8123DAACB209F509D49BDA7778AB10711F1002A7F908B7241EA789F858BD9
                                                            Function 0045A28B Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045A2B3
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045A30E
                                                            • RegQueryValueExW.ADVAPI32(000002C0,00000100,00000000,000002C0,00000000,00000000,000002C0,?,00000100,00000000,?,00000000,?,000002C0,000002C0,?), ref: 0045A32F
                                                            • RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,00000100,00000000,000002C0), ref: 0045A405
                                                            Strings
                                                            • Failed to open registry key. Key = '%ls', xrefs: 0045A3C7
                                                            • Registry key not found. Key = '%ls', xrefs: 0045A396
                                                            • search.cpp, xrefs: 0045A360
                                                            • Failed to query registry key value., xrefs: 0045A36A
                                                            • RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 0045A3DD
                                                            • Failed to set variable., xrefs: 0045A3BD
                                                            • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0045A37A
                                                            • Failed to format value string., xrefs: 0045A319
                                                            • Failed to format key string., xrefs: 0045A2BE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16$CloseQueryValue
                                                            • String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
                                                            • API String ID: 2702208347-46557908
                                                            • Opcode ID: 423648b1ef748bb441fe7962ca095548d78600e533baecc933bcdd66cfb936fa
                                                            • Instruction ID: 52cbfcbeee2036989123e3d125cb9ea6cfea5339ff791f479c68de411fecf734
                                                            • Opcode Fuzzy Hash: 423648b1ef748bb441fe7962ca095548d78600e533baecc933bcdd66cfb936fa
                                                            • Instruction Fuzzy Hash: 64410532D00124BBCF12AB95CC06FAEBE64EB04715F1042B7FC04B6253D6799E24969A
                                                            Function 0045B208 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 137COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,0045BAFB,00000008,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B210
                                                            • GetLastError.KERNEL32(?,0045BAFB,00000008,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 0045B21C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorHandleLastModule
                                                            • String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
                                                            • API String ID: 4242514867-926796631
                                                            • Opcode ID: 4bfc9521082a4fc011aaa29f6a2a0710882e87114b2529d42f8b212ac922c14e
                                                            • Instruction ID: 152d6276ff7693c75fce16dd8b8a198c0f5a259357f9c3c6e7d4e1202896c16f
                                                            • Opcode Fuzzy Hash: 4bfc9521082a4fc011aaa29f6a2a0710882e87114b2529d42f8b212ac922c14e
                                                            • Instruction Fuzzy Hash: D741FD31280310A7CF209A525C46F5F2A55EB85B73F75407BFD01AE283D76DD84A82ED
                                                            Function 0045694B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 133libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 0045699B
                                                            • GetLastError.KERNEL32 ref: 004569A5
                                                            • GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 004569E8
                                                            • GetLastError.KERNEL32 ref: 004569F2
                                                            • FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00456B03
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
                                                            • String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
                                                            • API String ID: 3057421322-109962352
                                                            • Opcode ID: 666ed3512f424b36d79ca7924de340048069c7252ecccaa05489ce141eb9bf19
                                                            • Instruction ID: 44037311a127ee35c0e146dbb2c2ea5fb37e13a55fd176879a81827cc2e51d23
                                                            • Opcode Fuzzy Hash: 666ed3512f424b36d79ca7924de340048069c7252ecccaa05489ce141eb9bf19
                                                            • Instruction Fuzzy Hash: C741F972D402389BDB219B659C057EE7AB4EB09711F4141ABED08B7241D7788E44CBD9
                                                            Function 004548EF Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130memorysynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00455466,?,?,?,?), ref: 00454920
                                                            • GetLastError.KERNEL32(?,?,?,00455466,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00454931
                                                            • ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00454A6E
                                                            • CloseHandle.KERNEL32(?,?,?,?,00455466,?,?,?,?,?,?,?,?,?,?,?), ref: 00454A77
                                                            Strings
                                                            • engine.cpp, xrefs: 00454955, 0045499E
                                                            • Failed to create the message window., xrefs: 004549CC
                                                            • Failed to set elevated pipe into thread local storage for logging., xrefs: 004549A8
                                                            • comres.dll, xrefs: 004549DD
                                                            • Failed to pump messages from parent process., xrefs: 00454A42
                                                            • Failed to allocate thread local storage for logging., xrefs: 0045495F
                                                            • Failed to connect to unelevated process., xrefs: 00454916
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AllocCloseErrorHandleLastMutexRelease
                                                            • String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
                                                            • API String ID: 687263955-1790235126
                                                            • Opcode ID: 1936dd3265a462f2b1056b0ad3dcd0f37d0fb8150d5a7c912b46095d8a88a34a
                                                            • Instruction ID: 5a8d5de675d9823150945ba95a124189980e419a89985c4e0b835d14b3aebea2
                                                            • Opcode Fuzzy Hash: 1936dd3265a462f2b1056b0ad3dcd0f37d0fb8150d5a7c912b46095d8a88a34a
                                                            • Instruction Fuzzy Hash: 7141F5B3A40615BBCB119BA1DC46FDFBA6CFB44715F10023BBE14A6101EB38AD9486DD
                                                            Function 00457FA5 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 216COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000,00000000,00000000,00000001,00000000,00000002,000000B9), ref: 00457FC2
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 004581EA
                                                            Strings
                                                            • Failed to write variable value as number., xrefs: 00458194
                                                            • feclient.dll, xrefs: 0045809D, 004580F3, 00458134
                                                            • Failed to get string., xrefs: 004581B5
                                                            • Failed to write included flag., xrefs: 004581D8
                                                            • Failed to write variable count., xrefs: 00457FDD
                                                            • Failed to write variable value type., xrefs: 004581CA
                                                            • Unsupported variable type., xrefs: 004581A7
                                                            • Failed to get numeric., xrefs: 004581BC
                                                            • Failed to write literal flag., xrefs: 004581C3
                                                            • Failed to get version., xrefs: 0045819B
                                                            • Failed to write variable name., xrefs: 004581D1
                                                            • Failed to write variable value as string., xrefs: 004581AE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
                                                            • API String ID: 3168844106-2118673349
                                                            • Opcode ID: c77c3e11987c05329f839315745b3f37c85c59114c6b8a37f5b669a6295896f3
                                                            • Instruction ID: 111382c7d377512b9e91bff1a4e258c91c5a36de01d2eb16af301600de20d506
                                                            • Opcode Fuzzy Hash: c77c3e11987c05329f839315745b3f37c85c59114c6b8a37f5b669a6295896f3
                                                            • Instruction Fuzzy Hash: 2571CF72D01A29EFCF12AE64C941BAF7BA4BB04755F10412BED0077252DF389D1A8B99
                                                            Function 004902F8 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 123COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0049033C
                                                            • GetComputerNameW.KERNEL32(?,?), ref: 00490394
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Name$ComputerFileModule
                                                            • String ID: --- logging level: %hs ---$8dK$=== Logging started: %ls ===$@dK$Computer : %ls$Executable: %ls v%d.%d.%d.%d$HdK$TdK$\dK$ddK
                                                            • API String ID: 2577110986-3087567193
                                                            • Opcode ID: 2157969c56b350692ce9b4c2bde76568ad14c990a71b2a0b1df0f2a6553e8543
                                                            • Instruction ID: 22630299826b2b366fd71ce16437bba578f9d03135cf00425c203ba505b395ad
                                                            • Opcode Fuzzy Hash: 2157969c56b350692ce9b4c2bde76568ad14c990a71b2a0b1df0f2a6553e8543
                                                            • Instruction Fuzzy Hash: 314144B29001189FCF219F65DD45AEA7BBCEB44304F4041FBEA09A3241D6389E958F6D
                                                            Function 004697B2 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,0046A843,00000000,00000000,00000000,?,00000000), ref: 004697CD
                                                            • GetLastError.KERNEL32(?,0046A843,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004697DD
                                                              • Part of subcall function 00494102: Sleep.KERNEL32(?,00000000,?,004685EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00454DBC), ref: 00494119
                                                            • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 004698E9
                                                            Strings
                                                            • Failed to move %ls to %ls, xrefs: 004698C1
                                                            • Failed to verify payload signature: %ls, xrefs: 00469838
                                                            • Failed to copy %ls to %ls, xrefs: 004698D7
                                                            • %ls payload from working path '%ls' to path '%ls', xrefs: 00469894
                                                            • Failed to open payload in working path: %ls, xrefs: 0046980C
                                                            • Failed to verify payload hash: %ls, xrefs: 00469875
                                                            • cache.cpp, xrefs: 00469801
                                                            • Moving, xrefs: 0046987F
                                                            • Copying, xrefs: 00469888, 00469893
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorFileHandleLastSleep
                                                            • String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
                                                            • API String ID: 1275171361-1604654059
                                                            • Opcode ID: 6b5759e042b25ee7eca59c2765e1160dbe12143632557f28ecd74f728f8c8003
                                                            • Instruction ID: 05f86bb19064d6e96dd43bd9337ce6f73651d8490defefe30521bf1da7bf9ba0
                                                            • Opcode Fuzzy Hash: 6b5759e042b25ee7eca59c2765e1160dbe12143632557f28ecd74f728f8c8003
                                                            • Instruction Fuzzy Hash: F231B8729506217BDE312A569C4AF6F2A1CDF52F54F11016BFD047B281F2B89C0096EF
                                                            Function 004565C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 004565FC
                                                              • Part of subcall function 00490ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00455EB2,00000000), ref: 00490AE0
                                                              • Part of subcall function 00490ACC: GetProcAddress.KERNEL32(00000000), ref: 00490AE7
                                                              • Part of subcall function 00490ACC: GetLastError.KERNEL32(?,?,?,00455EB2,00000000), ref: 00490AFE
                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00456628
                                                            • GetLastError.KERNEL32 ref: 00456636
                                                            • GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 0045666E
                                                            • GetLastError.KERNEL32 ref: 00456678
                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004566BB
                                                            • GetLastError.KERNEL32 ref: 004566C5
                                                            Strings
                                                            • Failed to set system folder variant value., xrefs: 00456724
                                                            • Failed to get 32-bit system folder., xrefs: 004566A6
                                                            • Failed to get 64-bit system folder., xrefs: 00456664
                                                            • variable.cpp, xrefs: 0045665A, 0045669C
                                                            • Failed to backslash terminate system folder., xrefs: 00456708
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
                                                            • String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
                                                            • API String ID: 325818893-1590374846
                                                            • Opcode ID: 5f7e5ba69b4e61f221132a4588a893c7facf7ebcde20243285439fa5bb6f4c4e
                                                            • Instruction ID: 618313f207590937efc6f910f734e8e2c4f5ff8490506d0d01fef799f6a462b2
                                                            • Opcode Fuzzy Hash: 5f7e5ba69b4e61f221132a4588a893c7facf7ebcde20243285439fa5bb6f4c4e
                                                            • Instruction Fuzzy Hash: 78315832D4123467CB20AB628D49B9F3A68AF10752F52417BBD04B7282D73CDD488AED
                                                            Function 00463F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00463AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00463FB5,feclient.dll,?,00000000,?,?,?,00454B12), ref: 00463B42
                                                            • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00454B12,?,?,0049B488,?,00000001,00000000,00000000), ref: 0046404C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseSleep
                                                            • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                            • API String ID: 2834455192-2673269691
                                                            • Opcode ID: f3934934d94151c7fa5fd5f38b3a4215680222c70c2a65b5dfd8f917bff7bfc1
                                                            • Instruction ID: 98cf9557d6c0ad6f3545f5d532fdcdf07f16bcbce5d188de40509ef478c104d2
                                                            • Opcode Fuzzy Hash: f3934934d94151c7fa5fd5f38b3a4215680222c70c2a65b5dfd8f917bff7bfc1
                                                            • Instruction Fuzzy Hash: 3261E271A00225AEDF169F64CC46BA77BA8EF52340F14416BFD00DB241F778ED90869A
                                                            Function 00456DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000001,?,00000000,00455445,00000006,?,004582B9,?,?,?,00000000,00000000,00000001), ref: 00456DC8
                                                              • Part of subcall function 004556A9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00456595,00456595,?,0045563D,?,?,00000000), ref: 004556E5
                                                              • Part of subcall function 004556A9: GetLastError.KERNEL32(?,0045563D,?,?,00000000,?,?,00456595,?,00457F02,?,?,?,?,?), ref: 00455714
                                                            • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,004582B9), ref: 00456F59
                                                            Strings
                                                            • Failed to set value of variable: %ls, xrefs: 00456F41
                                                            • Attempt to set built-in variable value: %ls, xrefs: 00456E56
                                                            • Setting hidden variable '%ls', xrefs: 00456E86
                                                            • Failed to find variable value '%ls'., xrefs: 00456DE3
                                                            • Unsetting variable '%ls', xrefs: 00456F15
                                                            • Setting string variable '%ls' to value '%ls', xrefs: 00456EED
                                                            • variable.cpp, xrefs: 00456E4B
                                                            • Failed to insert variable '%ls'., xrefs: 00456E0D
                                                            • Setting numeric variable '%ls' to value %lld, xrefs: 00456EFA
                                                            • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00456ED0
                                                            • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00456F6B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                            • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                            • API String ID: 2716280545-445000439
                                                            • Opcode ID: 253924d1bfa303e169db4016433edd63d99d7392dbd303db89fc6b3f616638d8
                                                            • Instruction ID: b92ff4532175c5b898b31d2868b4c516762e197fcdd5ead8de03fc6596afb46e
                                                            • Opcode Fuzzy Hash: 253924d1bfa303e169db4016433edd63d99d7392dbd303db89fc6b3f616638d8
                                                            • Instruction Fuzzy Hash: A251E772A40215ABCB309E19DC4AF6B3EA8EB51716F62016FFC0457283C27DDC45CAE9
                                                            Function 00462C1C Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 299COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00462C8A
                                                            Strings
                                                            • Failed to allocate registration action., xrefs: 00462CF3
                                                            • wininet.dll, xrefs: 00462ED7
                                                            • Failed to add registration action for dependent related bundle., xrefs: 00462F8E
                                                            • Failed to add dependent bundle provider key to ignore dependents., xrefs: 00462DF4
                                                            • Failed to add registration action for self dependent., xrefs: 00462F57
                                                            • Failed to add self-dependent to ignore dependents., xrefs: 00462D0E
                                                            • Failed to add dependents ignored from command-line., xrefs: 00462D3F
                                                            • crypt32.dll, xrefs: 00462CD5, 00462DCF, 00462EC4, 00462F39
                                                            • Failed to create the string dictionary., xrefs: 00462CC3
                                                            • Failed to check for remaining dependents during planning., xrefs: 00462E30
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
                                                            • API String ID: 1825529933-1705955799
                                                            • Opcode ID: 3d79e24cf9926c46ac15ed3569edc21ede311893a692eaf6a2ab5604cea7bbd8
                                                            • Instruction ID: a1b28eb68d3312854aa14521d28b7add22bde35c550e11fbf0476e8ad8afdc22
                                                            • Opcode Fuzzy Hash: 3d79e24cf9926c46ac15ed3569edc21ede311893a692eaf6a2ab5604cea7bbd8
                                                            • Instruction Fuzzy Hash: 93B19370A00A16FBCF299F54CA41AAA7BB5FF14300F10816BF814A7251E7B8D951DB9A
                                                            Function 0046F90B Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 187COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 0046F947
                                                            • UuidCreate.RPCRT4(?), ref: 0046FA2A
                                                            • StringFromGUID2.OLE32(?,?,00000027), ref: 0046FA4B
                                                            • LeaveCriticalSection.KERNEL32(?,?), ref: 0046FAF4
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046FA60
                                                            • Failed to convert bundle update guid into string., xrefs: 0046FA6A
                                                            • Failed to default local update source, xrefs: 0046F9B7
                                                            • Failed to recreate command-line for update bundle., xrefs: 0046FA12
                                                            • Failed to create bundle update guid., xrefs: 0046FA37
                                                            • update\%ls, xrefs: 0046F9A3
                                                            • Failed to set update bundle., xrefs: 0046FACE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$CreateEnterFromLeaveStringUuid
                                                            • String ID: EngineForApplication.cpp$Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
                                                            • API String ID: 171215650-2594647487
                                                            • Opcode ID: fcf1d9ebd420318c3afbb7eb78bc6220d0190c0211b48e04f8d486a902effd4d
                                                            • Instruction ID: b03892ae010b8413a03b9d0b4404743cabcf7ce966d1bd9dbcf4553d4f9ca6e7
                                                            • Opcode Fuzzy Hash: fcf1d9ebd420318c3afbb7eb78bc6220d0190c0211b48e04f8d486a902effd4d
                                                            • Instruction Fuzzy Hash: AE61B071940214ABCF21DFA4D845FAE7BB4EF08714F11417BF848AB251E7789C18CB9A
                                                            Function 00454AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • IsWindow.USER32(?), ref: 00454C64
                                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00454C75
                                                            Strings
                                                            • Failed while running , xrefs: 00454C2A
                                                            • Failed to create the message window., xrefs: 00454B98
                                                            • Failed to open log., xrefs: 00454B18
                                                            • WixBundleLayoutDirectory, xrefs: 00454BF5
                                                            • Failed to check global conditions, xrefs: 00454B49
                                                            • Failed to query registration., xrefs: 00454BAE
                                                            • Failed to set registration variables., xrefs: 00454BDE
                                                            • Failed to set layout directory variable to value provided from command-line., xrefs: 00454C06
                                                            • Failed to set action variables., xrefs: 00454BC4
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: MessagePostWindow
                                                            • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                            • API String ID: 3618638489-3051724725
                                                            • Opcode ID: dc26ac4634d43be48112786184f72f1d5e964d8208d4a58abc741bd4e848750e
                                                            • Instruction ID: 5c3daff8e54b7d9a1b508dd60fc60e112fd4225db9b70640a94c4148b474b8c0
                                                            • Opcode Fuzzy Hash: dc26ac4634d43be48112786184f72f1d5e964d8208d4a58abc741bd4e848750e
                                                            • Instruction Fuzzy Hash: A2412A3160161ABBCF175A20CD45FABB65CFF8075EF11022BFC049A142E768ED9896D9
                                                            Function 0046F051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 0046F06E
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0046F19B
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046F17C
                                                            • UX requested unknown approved exe with id: %ls, xrefs: 0046F0CE
                                                            • Engine is active, cannot change engine state., xrefs: 0046F089
                                                            • Failed to copy the arguments., xrefs: 0046F12D
                                                            • Failed to post launch approved exe message., xrefs: 0046F186
                                                            • Failed to copy the id., xrefs: 0046F100
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalHeapSection$AllocateEnterLeaveProcess
                                                            • String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
                                                            • API String ID: 1367039788-528931743
                                                            • Opcode ID: a2a9df49ef32ff7ee50603d167d1ccb2f4084844be22b205ef27258190d12bd6
                                                            • Instruction ID: c1431fc3bf26978ba5f9eb743d2a0f5c5279887b63f0f2c913e58ab6c826419b
                                                            • Opcode Fuzzy Hash: a2a9df49ef32ff7ee50603d167d1ccb2f4084844be22b205ef27258190d12bd6
                                                            • Instruction Fuzzy Hash: 8931D132A40225EFCB219F64EC05E9A37A8AF117A0B114577FC44EB251FB28DD0486DA
                                                            Function 0046969D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,0046A7D4,00000000,00000000,00000000,?,00000000), ref: 004696B8
                                                            • GetLastError.KERNEL32(?,0046A7D4,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004696C6
                                                              • Part of subcall function 00494102: Sleep.KERNEL32(?,00000000,?,004685EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00454DBC), ref: 00494119
                                                            • CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 004697A4
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorFileHandleLastSleep
                                                            • String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
                                                            • API String ID: 1275171361-1187406825
                                                            • Opcode ID: ef1bc72b4c973901a41c84e86918f8a7559924811dcf42e8bb0e0bc9afefa40b
                                                            • Instruction ID: 5ca8bc960deda80341d472150a308d3593798c73bab80d0d3ec9d87deed49a8d
                                                            • Opcode Fuzzy Hash: ef1bc72b4c973901a41c84e86918f8a7559924811dcf42e8bb0e0bc9afefa40b
                                                            • Instruction Fuzzy Hash: AD21FD72A80224BBDB311A558C46F6F2A1CDF51F55F11016BFD047A2C1E2B99C0185EF
                                                            Function 00456F85 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00456FB2
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 004571BE
                                                            Strings
                                                            • Failed to read variable value type., xrefs: 004571A0
                                                            • Failed to read variable value as number., xrefs: 00457178
                                                            • Failed to set variable value., xrefs: 00457171
                                                            • Failed to read variable included flag., xrefs: 004571AE
                                                            • Failed to read variable name., xrefs: 004571A7
                                                            • Unsupported variable type., xrefs: 00457184
                                                            • Failed to read variable literal flag., xrefs: 00457199
                                                            • Failed to read variable count., xrefs: 00456FD2
                                                            • Failed to set variable., xrefs: 00457192
                                                            • Failed to read variable value as string., xrefs: 0045718B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
                                                            • API String ID: 3168844106-528957463
                                                            • Opcode ID: 4bb768946b88d46295bd3a62e4deab909322204919859a0fdc3b9728e7118f90
                                                            • Instruction ID: c5281995728061bda8db7cd1fdd027c2dfc485aa4732716e58d35c75bd64a221
                                                            • Opcode Fuzzy Hash: 4bb768946b88d46295bd3a62e4deab909322204919859a0fdc3b9728e7118f90
                                                            • Instruction Fuzzy Hash: B271B372C0451AABCF11DEA4ED01EAF7BB9EF00745F104137FD00A6252D7389E199BA8
                                                            Function 004944D1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00494550
                                                            • GetLastError.KERNEL32 ref: 00494566
                                                            • GetFileSizeEx.KERNEL32(00000000,?), ref: 004945BF
                                                            • GetLastError.KERNEL32 ref: 004945C9
                                                            • SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 0049461D
                                                            • GetLastError.KERNEL32 ref: 00494628
                                                            • ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00494717
                                                            • CloseHandle.KERNEL32(?), ref: 0049478A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 3286166115-2967768451
                                                            • Opcode ID: 998697090dff3ed6ffb556d1613b96cb08d768c9a8bdafde2e1943efdf3367e9
                                                            • Instruction ID: 83727e99b2d20c02f0739c2c0cb53ed1d2456788f98926b99b93b8de05f075b9
                                                            • Opcode Fuzzy Hash: 998697090dff3ed6ffb556d1613b96cb08d768c9a8bdafde2e1943efdf3367e9
                                                            • Instruction Fuzzy Hash: C6811671A40216ABDF208E99DC45F6F2A98AB81764F12017BFD15EB380D77CDD0286DD
                                                            Function 00452DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00452E5F
                                                            • GetLastError.KERNEL32 ref: 00452E69
                                                            • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00452F09
                                                            • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00452F96
                                                            • GetLastError.KERNEL32 ref: 00452FA3
                                                            • Sleep.KERNEL32(00000064), ref: 00452FB7
                                                            • CloseHandle.KERNEL32(?), ref: 0045301F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                            • String ID: 4Mw$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                            • API String ID: 3480017824-721117420
                                                            • Opcode ID: 903f59d1d658975e6b7b02c7b699f39d66489d0825e8c20d3fe217431e83bffa
                                                            • Instruction ID: da7d9446f52cbea7cf23f3c587cd4baf0dad90f93dd058e7335dad8ae9e62009
                                                            • Opcode Fuzzy Hash: 903f59d1d658975e6b7b02c7b699f39d66489d0825e8c20d3fe217431e83bffa
                                                            • Instruction Fuzzy Hash: 6C71B872D01229ABDB309F55DD49BAEB7B4AB08712F0001E7FD04A7291D7789E84CF98
                                                            Function 00464D8D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • UuidCreate.RPCRT4(?), ref: 00464DC0
                                                            • StringFromGUID2.OLE32(?,?,00000027), ref: 00464DEF
                                                            • UuidCreate.RPCRT4(?), ref: 00464E3A
                                                            • StringFromGUID2.OLE32(?,?,00000027), ref: 00464E66
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateFromStringUuid
                                                            • String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
                                                            • API String ID: 4041566446-2510341293
                                                            • Opcode ID: 08bb67a5551060b75ce0775c0c15acf159e3e0e0eb7366143a0ca05b35e62837
                                                            • Instruction ID: b234ff508fbe96b96857ac48fb91c83a5d5e423be64486219fb2977bf0081a67
                                                            • Opcode Fuzzy Hash: 08bb67a5551060b75ce0775c0c15acf159e3e0e0eb7366143a0ca05b35e62837
                                                            • Instruction Fuzzy Hash: 02417E72D00308ABCF21DBE5D905FDEB7F8AB95714F20012BF905BB241E6799905CB9A
                                                            Function 0046EA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,0045548E,?,?), ref: 0046EA9D
                                                            • GetLastError.KERNEL32(?,0045548E,?,?), ref: 0046EAAA
                                                            • CreateThread.KERNEL32(00000000,00000000,0046E7B4,?,00000000,00000000), ref: 0046EB03
                                                            • GetLastError.KERNEL32(?,0045548E,?,?), ref: 0046EB10
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,0045548E,?,?), ref: 0046EB4B
                                                            • CloseHandle.KERNEL32(00000000,?,0045548E,?,?), ref: 0046EB6A
                                                            • CloseHandle.KERNEL32(?,?,0045548E,?,?), ref: 0046EB77
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                            • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                            • API String ID: 2351989216-3599963359
                                                            • Opcode ID: f83a2b0aae60ca36b7ce067165fef32c2e93f1ec9f00d5ff954f6585e8371e26
                                                            • Instruction ID: 9c798e3de8d48e3157dd7613ad31be17aa2d86c870b692ed1e1fd4d9598e69f3
                                                            • Opcode Fuzzy Hash: f83a2b0aae60ca36b7ce067165fef32c2e93f1ec9f00d5ff954f6585e8371e26
                                                            • Instruction Fuzzy Hash: 5031A576D41219BBDB10DF9A9D85A9FBAE8FB14750F11007BF904F7281E2349E0086A6
                                                            Function 0046E645 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,0045548E,?,?), ref: 0046E666
                                                            • GetLastError.KERNEL32(?,?,0045548E,?,?), ref: 0046E673
                                                            • CreateThread.KERNEL32(00000000,00000000,0046E3C8,00000000,00000000,00000000), ref: 0046E6D2
                                                            • GetLastError.KERNEL32(?,?,0045548E,?,?), ref: 0046E6DF
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,0045548E,?,?), ref: 0046E71A
                                                            • CloseHandle.KERNEL32(?,?,?,0045548E,?,?), ref: 0046E72E
                                                            • CloseHandle.KERNEL32(?,?,?,0045548E,?,?), ref: 0046E73B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                            • String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
                                                            • API String ID: 2351989216-1977201954
                                                            • Opcode ID: e2026fe5a8c017fbfc40b2520c8f35ed6abc3b2359f6cd2e7099c8a294052486
                                                            • Instruction ID: b560a6821746b7c8cc9b774fa7f0e491a5f3824484b09196cae87385ac28c6cb
                                                            • Opcode Fuzzy Hash: e2026fe5a8c017fbfc40b2520c8f35ed6abc3b2359f6cd2e7099c8a294052486
                                                            • Instruction Fuzzy Hash: 5D31A47AD40229BBDB109B9ADD05A9FBBF8EB54711F11417BFD10F6240E7385D008AEA
                                                            Function 004714E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,774D2F60,?,?,00455405,004553BD,00000000,00455445), ref: 00471506
                                                            • GetLastError.KERNEL32 ref: 00471519
                                                            • GetExitCodeThread.KERNEL32(0049B488,?), ref: 0047155B
                                                            • GetLastError.KERNEL32 ref: 00471569
                                                            • ResetEvent.KERNEL32(0049B460), ref: 004715A4
                                                            • GetLastError.KERNEL32 ref: 004715AE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                            • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                            • API String ID: 2979751695-3400260300
                                                            • Opcode ID: f9dec7c3afd5e9f2f43084bb1e22ee0ed118cf5c4e3dab58d041e5e2a1f2fad8
                                                            • Instruction ID: ddffc9dc125098304d92a6b17dc3de7d310f99046548a7ccca60e2ceaeb01a81
                                                            • Opcode Fuzzy Hash: f9dec7c3afd5e9f2f43084bb1e22ee0ed118cf5c4e3dab58d041e5e2a1f2fad8
                                                            • Instruction Fuzzy Hash: 3D31A470A40205BBD7149F6A9D05BAF7BE8EB54700B20806BF90AD6260E738DA00DB5D
                                                            Function 004715FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetEvent.KERNEL32(0049B478,?,00000000,?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000,?), ref: 0047161B
                                                            • GetLastError.KERNEL32(?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000,?,00455489,FFF9E89D,00455489), ref: 00471625
                                                            • WaitForSingleObject.KERNEL32(0049B488,000000FF,?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000,?,00455489), ref: 0047165F
                                                            • GetLastError.KERNEL32(?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000,?,00455489,FFF9E89D,00455489), ref: 00471669
                                                            • CloseHandle.KERNEL32(00000000,00455489,?,00000000,?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000), ref: 004716B4
                                                            • CloseHandle.KERNEL32(00000000,00455489,?,00000000,?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000), ref: 004716C3
                                                            • CloseHandle.KERNEL32(00000000,00455489,?,00000000,?,0045C1D3,?,004553BD,00000000,?,0046784D,?,0045566D,00455479,00455479,00000000), ref: 004716D2
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$ErrorLast$EventObjectSingleWait
                                                            • String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
                                                            • API String ID: 1206859064-226982402
                                                            • Opcode ID: 2c16c79d818099587f22670b90d753662d4e9b91f32dbf8249985751f9e7e9c2
                                                            • Instruction ID: 016fa823ac5499d54d48027a9b5cad38d266d1ce35cf4d416e021be467ba47a8
                                                            • Opcode Fuzzy Hash: 2c16c79d818099587f22670b90d753662d4e9b91f32dbf8249985751f9e7e9c2
                                                            • Instruction Fuzzy Hash: 65212632500622BBC7215B6ADC0979AB6A4FF14726F15422BE80C61AB0D37CEC60CADD
                                                            Function 004641EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490523: EnterCriticalSection.KERNEL32(004BB5FC,00000000,?,?,?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?), ref: 00490533
                                                              • Part of subcall function 00490523: LeaveCriticalSection.KERNEL32(004BB5FC,?,?,004BB5F4,?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?), ref: 0049067A
                                                            • OpenEventLogW.ADVAPI32(00000000,Application), ref: 00464212
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 0046421E
                                                            • ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,004A39D4,00000000), ref: 0046426B
                                                            • CloseEventLog.ADVAPI32(00000000), ref: 00464272
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
                                                            • String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
                                                            • API String ID: 1844635321-1389066741
                                                            • Opcode ID: bd3cfa445eecfc807dd30dfa028d4c6c8e20883e329b754d3d7ffcd05d1f9630
                                                            • Instruction ID: 51abcc143eda301667c2ab6ae802f27aca944d4579bc48ade731bcee6cb521d2
                                                            • Opcode Fuzzy Hash: bd3cfa445eecfc807dd30dfa028d4c6c8e20883e329b754d3d7ffcd05d1f9630
                                                            • Instruction Fuzzy Hash: 17F0D632A812717A5A312A622C1AE7B5D6CDAE3FB2321006BFD00E1141F74C9D0140FE
                                                            Function 004693FE Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 226COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 0046949E
                                                            • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 004694C6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast
                                                            • String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
                                                            • API String ID: 1452528299-4263581490
                                                            • Opcode ID: 20218f62837c7d18752e92ae325dbd80d61c0c5ec5d8872560d4882035e5f10d
                                                            • Instruction ID: 86ff124b3e3e919cc08b99e85b7521de1e8d43453acb25c96faaeb86687d4ece
                                                            • Opcode Fuzzy Hash: 20218f62837c7d18752e92ae325dbd80d61c0c5ec5d8872560d4882035e5f10d
                                                            • Instruction Fuzzy Hash: 33716472D00229ABDB11DF95CC41BEEBBB8AB05750F11012BED15BB241E7789D058BAA
                                                            Function 0046E56C Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetWindowLongW.USER32(?,000000EB), ref: 0046E577
                                                            • DefWindowProcW.USER32(?,00000082,?,?), ref: 0046E5B5
                                                            • SetWindowLongW.USER32(?,000000EB,00000000), ref: 0046E5C2
                                                            • SetWindowLongW.USER32(?,000000EB,?), ref: 0046E5D1
                                                            • DefWindowProcW.USER32(?,?,?,?), ref: 0046E5DF
                                                            • CreateCompatibleDC.GDI32(?), ref: 0046E5EB
                                                            • SelectObject.GDI32(00000000,00000000), ref: 0046E5FC
                                                            • StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0046E61E
                                                            • SelectObject.GDI32(00000000,00000000), ref: 0046E626
                                                            • DeleteDC.GDI32(00000000), ref: 0046E629
                                                            • PostQuitMessage.USER32(00000000), ref: 0046E637
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
                                                            • String ID:
                                                            • API String ID: 409979828-0
                                                            • Opcode ID: 19594fa5aa417d688631528f3a257bb90548c36c3d0fe072db9981de0d078088
                                                            • Instruction ID: 9014077b4d08d3f5cd75ebf51c6500d84dfb60cf1c9602afba6d67563ccf5426
                                                            • Opcode Fuzzy Hash: 19594fa5aa417d688631528f3a257bb90548c36c3d0fe072db9981de0d078088
                                                            • Instruction Fuzzy Hash: 0121BD36100114BFCB259FA9ED0CD7B3FA8EF69720B11453AFA16861B0E7358810DBA9
                                                            Function 0046A13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • WixBundleLastUsedSource, xrefs: 0046A1A1
                                                            • WixBundleOriginalSource, xrefs: 0046A1B7
                                                            • WixBundleLayoutDirectory, xrefs: 0046A26C
                                                            • Failed to get bundle layout directory property., xrefs: 0046A287
                                                            • Failed to combine last source with source., xrefs: 0046A210
                                                            • Failed to combine layout source with source., xrefs: 0046A2A4
                                                            • Failed to copy source path., xrefs: 0046A31A
                                                            • Failed to get current process directory., xrefs: 0046A1F3
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Find$CloseFileFirstlstrlen
                                                            • String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
                                                            • API String ID: 2767606509-3003062821
                                                            • Opcode ID: 935e84a188aacf94cfa1a797ef7c54d6d8d83530f608662f26e4586bf61e6b61
                                                            • Instruction ID: 997b1638eda6da35c32fe8cee058de9c834acceac90988122d7fdc48e969b152
                                                            • Opcode Fuzzy Hash: 935e84a188aacf94cfa1a797ef7c54d6d8d83530f608662f26e4586bf61e6b61
                                                            • Instruction Fuzzy Hash: 48718D71D00619AFCF16DFA8D841AEEBBB9AF09314F14012BE900B7350E7799D518F6A
                                                            Function 00453076 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 210COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 004530C1
                                                            • GetLastError.KERNEL32 ref: 004530C7
                                                            • ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00453121
                                                            • GetLastError.KERNEL32 ref: 00453127
                                                            • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004531DB
                                                            • GetLastError.KERNEL32 ref: 004531E5
                                                            • GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045323B
                                                            • GetLastError.KERNEL32 ref: 00453245
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
                                                            • String ID: pathutil.cpp
                                                            • API String ID: 1547313835-741606033
                                                            • Opcode ID: 3c5d41eaa9917b5b93e2c5618f86f3110934608da62be1de391583dc3fc42317
                                                            • Instruction ID: c7857632ac6a104b8d348a41f057b6605d05af85811f2eccdd019cbd21ab9d06
                                                            • Opcode Fuzzy Hash: 3c5d41eaa9917b5b93e2c5618f86f3110934608da62be1de391583dc3fc42317
                                                            • Instruction Fuzzy Hash: C161E933D00629B7DB219EE58945B9FB764AB00797F1141A7FE00BB252E7399F0887D8
                                                            Function 00496D50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 165COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,774CDFD0,?,004972C8,?,?), ref: 00496DA6
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496E11
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496E89
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496EC8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$Free$Compare
                                                            • String ID: label$scheme$term
                                                            • API String ID: 1324494773-4117840027
                                                            • Opcode ID: d7f1b9c1ba08b308b4510430089d6986583c32f70adfa871c7e099890342d50c
                                                            • Instruction ID: 8190b2ced63461a24e75ebd854c92bd24248d82a7269ca35faa922e7941999be
                                                            • Opcode Fuzzy Hash: d7f1b9c1ba08b308b4510430089d6986583c32f70adfa871c7e099890342d50c
                                                            • Instruction Fuzzy Hash: 35516E75901219EFCF15DBA4C945FAEBFB9EF04711F2102BAF521A62A0D7349E00DB54
                                                            Function 0045CBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,004553BD,00000000,00455489,00455445,WixBundleUILevel,840F01E8,?,00000001), ref: 0045CC1C
                                                            Strings
                                                            • Failed to get next stream., xrefs: 0045CD03
                                                            • Failed to extract file., xrefs: 0045CCE7
                                                            • Failed to ensure directory exists, xrefs: 0045CCEE
                                                            • payload.cpp, xrefs: 0045CD1D
                                                            • Failed to get directory portion of local file path, xrefs: 0045CCF5
                                                            • Failed to find embedded payload: %ls, xrefs: 0045CC48
                                                            • Failed to concat file paths., xrefs: 0045CCFC
                                                            • Payload was not found in container: %ls, xrefs: 0045CD29
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                            • API String ID: 1825529933-1711239286
                                                            • Opcode ID: 6968675fe500e1af4c82c3883153feed6db1b7455289c953b213106e69efc5a0
                                                            • Instruction ID: d8ac8fc7535f861602ac005442568f3c80a2699a10e3721087792e97250b291e
                                                            • Opcode Fuzzy Hash: 6968675fe500e1af4c82c3883153feed6db1b7455289c953b213106e69efc5a0
                                                            • Instruction Fuzzy Hash: 7541B131900319EFCF269F45CDC1AAEBB75AF00712B20817BEC05AB252D7789D49DB99
                                                            Function 00454796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 004547BB
                                                            • GetCurrentThreadId.KERNEL32 ref: 004547C1
                                                            • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0045484F
                                                            Strings
                                                            • Unexpected return value from message pump., xrefs: 004548A5
                                                            • Failed to start bootstrapper application., xrefs: 0045481D
                                                            • engine.cpp, xrefs: 0045489B
                                                            • Failed to load UX., xrefs: 00454804
                                                            • wininet.dll, xrefs: 004547EE
                                                            • Failed to create engine for UX., xrefs: 004547DB
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Message$CurrentPeekThread
                                                            • String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
                                                            • API String ID: 673430819-2573580774
                                                            • Opcode ID: 462f9a2bf464f7a4f1dab56ced6d3d7cc49ed5b2558bad1ede4eb30f3a69cf3c
                                                            • Instruction ID: b36998431dc3ad08b0ea61ee061ca6476fbe50db06ec8ec812e41bba7adec6df
                                                            • Opcode Fuzzy Hash: 462f9a2bf464f7a4f1dab56ced6d3d7cc49ed5b2558bad1ede4eb30f3a69cf3c
                                                            • Instruction Fuzzy Hash: 2041E471A00155BFDB10ABA0DC85EBAB76CEF44319F10013BFD04EB252DB38AD4987A9
                                                            Function 00479C84 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 128COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,0047B03E,?,00000001,00000000), ref: 00479D0F
                                                            • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0047B03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00479D19
                                                            • CopyFileExW.KERNEL32(00000000,00000000,00479B69,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00479D67
                                                            • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0047B03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00479D96
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$AttributesCopy
                                                            • String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
                                                            • API String ID: 1969131206-836986073
                                                            • Opcode ID: a365d866bcb7b1a0dd1fba5adef5219ca7e4eb7d67f9caa0ea6f2de22b3d7262
                                                            • Instruction ID: fbd59867d967c7f93b39a990eb9db00a183a68c4ef5cf0d1f143650871a42de1
                                                            • Opcode Fuzzy Hash: a365d866bcb7b1a0dd1fba5adef5219ca7e4eb7d67f9caa0ea6f2de22b3d7262
                                                            • Instruction Fuzzy Hash: 6031F632A41511BBDF309A968C45EEB77A8EF52B51B14C16BBC08AB341E72CDD0186ED
                                                            Function 00468EBC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00469007
                                                            Strings
                                                            • Failed to allocate access for Users group to path: %ls, xrefs: 00468F72
                                                            • Failed to create ACL to secure cache path: %ls, xrefs: 00468FBB
                                                            • Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00468F30
                                                            • Failed to allocate access for Everyone group to path: %ls, xrefs: 00468F51
                                                            • Failed to secure cache path: %ls, xrefs: 00468FEA
                                                            • Failed to allocate access for Administrators group to path: %ls, xrefs: 00468F0F
                                                            • cache.cpp, xrefs: 00468FB0
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeLocal
                                                            • String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
                                                            • API String ID: 2826327444-4113288589
                                                            • Opcode ID: 45370d670064df581bf04418bba73044a0e28362bfb7d8c4fc1815fe50eb02b2
                                                            • Instruction ID: 01c1247f122e78972b8929ea0623f7e5b8f87df8446fb73985fb591396a7dbd6
                                                            • Opcode Fuzzy Hash: 45370d670064df581bf04418bba73044a0e28362bfb7d8c4fc1815fe50eb02b2
                                                            • Instruction Fuzzy Hash: 8241F832E40325B7DB3156508C05FAA7769EB51B10F11426BFA04BA181FFB99E4487EE
                                                            Function 0046492F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ReadFile.KERNEL32(00000000,crypt32.dll,00000008,?,00000000,?,00000000,00000000,crypt32.dll,00000000,?,?,?,00000000,?,00000000), ref: 0046495A
                                                            • GetLastError.KERNEL32 ref: 00464967
                                                            • ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 00464A12
                                                            • GetLastError.KERNEL32 ref: 00464A1C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastRead
                                                            • String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$crypt32.dll$pipe.cpp
                                                            • API String ID: 1948546556-773887359
                                                            • Opcode ID: ae852436ba0428ab3d3e717cae5f6d482617c04f90cd2980a3d8363ee8846ed0
                                                            • Instruction ID: 23d18814630c9fb7ac7ab4a768543b1eeaccfb46ffc28652b2cc28e91c24162f
                                                            • Opcode Fuzzy Hash: ae852436ba0428ab3d3e717cae5f6d482617c04f90cd2980a3d8363ee8846ed0
                                                            • Instruction Fuzzy Hash: 7D310A72980225BBDF109EE58C05B6FBA68EB90765F10813BFC40A6241E7789D0486DE
                                                            Function 0046E2AF Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadBitmapW.USER32(?,00000001), ref: 0046E2E5
                                                            • GetLastError.KERNEL32 ref: 0046E2F1
                                                            • GetObjectW.GDI32(00000000,00000018,?), ref: 0046E338
                                                            • GetCursorPos.USER32(?), ref: 0046E359
                                                            • MonitorFromPoint.USER32(?,?,00000002), ref: 0046E36B
                                                            • GetMonitorInfoW.USER32(00000000,?), ref: 0046E381
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
                                                            • String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
                                                            • API String ID: 2342928100-598475503
                                                            • Opcode ID: 2450019eebb492137f56332388dbec88c3f0b275f18f0ffd169d1f772c62fac3
                                                            • Instruction ID: e72ba49578c141ac2ab92fffe5ed304b3446a1331b09df7f1a17862ea5795bcf
                                                            • Opcode Fuzzy Hash: 2450019eebb492137f56332388dbec88c3f0b275f18f0ffd169d1f772c62fac3
                                                            • Instruction Fuzzy Hash: 7B314575A00219AFDB10DFA9D949A9EBBF4EF18710F14812AFD04EB381E774E9408B95
                                                            Function 004650CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcessId.KERNEL32(?,00000000,?,?,0049B500), ref: 004650D3
                                                            • GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00465171
                                                            • CloseHandle.KERNEL32(00000000), ref: 0046518A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Process$CloseCurrentHandle
                                                            • String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
                                                            • API String ID: 2815245435-1352204306
                                                            • Opcode ID: c52142d1ec35c2484b427cd75ded6d85e4dbbf077486c70f6f5a8fb4b3fbfeb1
                                                            • Instruction ID: a6efe6226eccecd0375f07e9d82f72059802eaf3c085ab78953fa97e84174603
                                                            • Opcode Fuzzy Hash: c52142d1ec35c2484b427cd75ded6d85e4dbbf077486c70f6f5a8fb4b3fbfeb1
                                                            • Instruction Fuzzy Hash: BD218B71D00609FF8F119F95DC41AAEBB78EF5A354B10817BF804A2211E7785E109B99
                                                            Function 00456882 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 75libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 004568AC
                                                            • GetProcAddress.KERNEL32(00000000), ref: 004568B3
                                                            • GetLastError.KERNEL32 ref: 004568BD
                                                            Strings
                                                            • msi, xrefs: 004568A3
                                                            • Failed to find DllGetVersion entry point in msi.dll., xrefs: 004568EB
                                                            • DllGetVersion, xrefs: 0045689E
                                                            • Failed to get msi.dll version info., xrefs: 00456905
                                                            • variable.cpp, xrefs: 004568E1
                                                            • Failed to set variant value., xrefs: 00456929
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorHandleLastModuleProc
                                                            • String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
                                                            • API String ID: 4275029093-842451892
                                                            • Opcode ID: 7d07c373065de9de8b7257eaef2de73fbe7c21301c63538668ba988402fb58f7
                                                            • Instruction ID: 1f9f9df76f65bce892d5032fea78e212a9e20bcfc8c4d1250af2b9084f6ef8df
                                                            • Opcode Fuzzy Hash: 7d07c373065de9de8b7257eaef2de73fbe7c21301c63538668ba988402fb58f7
                                                            • Instruction Fuzzy Hash: 75110A72E41239BADB206BB99C42ABFBBA4DB04711F51017BFD01F7242D63C9C0482E9
                                                            Function 0045D6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,004547FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0045548E,?), ref: 0045D6DA
                                                            • GetLastError.KERNEL32(?,004547FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0045548E,?,?), ref: 0045D6E7
                                                            • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0045D71F
                                                            • GetLastError.KERNEL32(?,004547FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,0045548E,?,?), ref: 0045D72B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$AddressLibraryLoadProc
                                                            • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                            • API String ID: 1866314245-2276003667
                                                            • Opcode ID: 8fc34609bb5989f16204004beb63341627c359c2b59020ae7ee23b66dc441587
                                                            • Instruction ID: f336ae4bb9aa4c274d6d78de6140845115b936e525682caf59b8f65442fb02e0
                                                            • Opcode Fuzzy Hash: 8fc34609bb5989f16204004beb63341627c359c2b59020ae7ee23b66dc441587
                                                            • Instruction Fuzzy Hash: C211C437E80B32A7CB3156955C05F1F6A94AF08B62F11453BFE14EB281EB28DC0886DC
                                                            Function 00451175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 00451186
                                                            • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 00451191
                                                            • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0045119F
                                                            • GetLastError.KERNEL32(?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 004511BA
                                                            • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004511C2
                                                            • GetLastError.KERNEL32(?,?,?,?,?,0045111A,cabinet.dll,00000009,?,?,00000000), ref: 004511D7
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorLastProc$HandleHeapInformationModule
                                                            • String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
                                                            • API String ID: 3104334766-1824683568
                                                            • Opcode ID: 0aabbb8ddc66a199f378d9905ec5c332a4dd7368cfb1d19780f0e1aa25280ed5
                                                            • Instruction ID: 08be530402b7efaba2a667459e4f260663a3c4c2eb25f99b923a45468ae6a236
                                                            • Opcode Fuzzy Hash: 0aabbb8ddc66a199f378d9905ec5c332a4dd7368cfb1d19780f0e1aa25280ed5
                                                            • Instruction Fuzzy Hash: 6701DE3124031ABA8A106BA2AD49F6F7F5CEB447A6B004037FE1592211EB749A048AF8
                                                            Function 0046F639 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 0046F64E
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0046F7C9
                                                            Strings
                                                            • Failed to set download user., xrefs: 0046F751
                                                            • Failed to set download URL., xrefs: 0046F728
                                                            • Failed to set download password., xrefs: 0046F777
                                                            • Engine is active, cannot change engine state., xrefs: 0046F668
                                                            • UX requested unknown container with id: %ls, xrefs: 0046F6F3
                                                            • UX did not provide container or payload id., xrefs: 0046F7B8
                                                            • UX denied while trying to set download URL on embedded payload: %ls, xrefs: 0046F6B9
                                                            • UX requested unknown payload with id: %ls, xrefs: 0046F6A3
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                            • API String ID: 3168844106-2615595102
                                                            • Opcode ID: 3196227dbf2ea6ce7e3117cc847c546e8d4e625f1cd5ea3542ca85127ba24e8e
                                                            • Instruction ID: 7b38d65846e0be2754c5ed73bd9971fc9b3ebfc2514eaa19135201891344c525
                                                            • Opcode Fuzzy Hash: 3196227dbf2ea6ce7e3117cc847c546e8d4e625f1cd5ea3542ca85127ba24e8e
                                                            • Instruction Fuzzy Hash: 29410272900611AFCB219F24E845B6B77A8AF01712B24417BF844A7250FB3CEC58C79F
                                                            Function 00495A5E Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196filememoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00495A9B
                                                            • GetLastError.KERNEL32 ref: 00495AA9
                                                            • VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00495AEA
                                                            • GetLastError.KERNEL32 ref: 00495AF7
                                                            • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00495C6A
                                                            • CloseHandle.KERNEL32(?), ref: 00495C79
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
                                                            • String ID: GET$dlutil.cpp
                                                            • API String ID: 2028584396-3303425918
                                                            • Opcode ID: c5eedd721694daa5568f7922874c089887781df45179b4bca040d469cceff375
                                                            • Instruction ID: deee2a6cd1d5c05900d11d1bc56b08053627f0f82c3e7324e1536384e81cef21
                                                            • Opcode Fuzzy Hash: c5eedd721694daa5568f7922874c089887781df45179b4bca040d469cceff375
                                                            • Instruction Fuzzy Hash: 38615D72900619ABDF22CFA5CD45BEE7FB8AF48754F25013AFD14A6240E738D9408B98
                                                            Function 00460C50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00461020: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00460C6F,?,00000000,?,00000000,00000000), ref: 0046104F
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00460DF3
                                                            • GetLastError.KERNEL32 ref: 00460E00
                                                            Strings
                                                            • Failed to create syncpoint event., xrefs: 00460E2E
                                                            • Failed to append payload cache action., xrefs: 00460DAA
                                                            • Failed to append rollback cache action., xrefs: 00460CCF
                                                            • Failed to append package start action., xrefs: 00460C95
                                                            • plan.cpp, xrefs: 00460E24
                                                            • Failed to append cache action., xrefs: 00460D4A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareCreateErrorEventLastString
                                                            • String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
                                                            • API String ID: 801187047-2489563283
                                                            • Opcode ID: 97650990f23516c41ed50fca91a19ca128f5b48a6fe9014eec6a41ddb9284528
                                                            • Instruction ID: 091f2739dbdb7e57af09b1604f5229ffeba0c7940215d7e29ca14de555c4a9c7
                                                            • Opcode Fuzzy Hash: 97650990f23516c41ed50fca91a19ca128f5b48a6fe9014eec6a41ddb9284528
                                                            • Instruction Fuzzy Hash: 7D619B75900604EFCB05CF59C980AABBBF9EF88314F21846BE9059B311EB35EE41DB55
                                                            Function 004605A2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 133registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,0049B500,00000000,?), ref: 004606D3
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,0049B500,00000000,?), ref: 004606E2
                                                              • Part of subcall function 00490BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,0046061A,?,00000000,00020006), ref: 00490C0E
                                                            Strings
                                                            • %ls.RebootRequired, xrefs: 004605F0
                                                            • Failed to write volatile reboot required registry key., xrefs: 0046061E
                                                            • Failed to delete registration key: %ls, xrefs: 00460681
                                                            • crypt32.dll, xrefs: 004605AC
                                                            • Failed to update resume mode., xrefs: 004606B7
                                                            • Failed to open registration key., xrefs: 0046071A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close$Create
                                                            • String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.$crypt32.dll
                                                            • API String ID: 359002179-3398658923
                                                            • Opcode ID: 87c29b679fdf44efbcf02b7642c8b8fbf4087c4d7113b6dd66c033c15eb556a4
                                                            • Instruction ID: 1b15ccef1cd729c75bc45e7195e80e3a163c7198f99f515eece128a6cc5d8439
                                                            • Opcode Fuzzy Hash: 87c29b679fdf44efbcf02b7642c8b8fbf4087c4d7113b6dd66c033c15eb556a4
                                                            • Instruction Fuzzy Hash: A641B471800304FBCF22AFA1CC06EAF7BB9AF90714F10406FF80561161E7799A64DB5A
                                                            Function 0046D24B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 118threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateThread.KERNEL32(00000000,00000000,0046AD40,?,00000000,00000000), ref: 0046D2E9
                                                            • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0046D2F5
                                                              • Part of subcall function 0046CF25: WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?), ref: 0046CF37
                                                              • Part of subcall function 0046CF25: GetLastError.KERNEL32(?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0046CF41
                                                            • CloseHandle.KERNEL32(00000000,00000000,?,?,0046C7C9,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 0046D376
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
                                                            • String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$QEE$elevation.cpp$fTE
                                                            • API String ID: 3606931770-1925291116
                                                            • Opcode ID: 051f6a827bce79c66d7d27af881ca03b03099689ff7baabf4a11b0fc079326c0
                                                            • Instruction ID: 541cb6e01fbdea0a2f31362f9b7ba59d1b175669299a15408de9de2ef1188573
                                                            • Opcode Fuzzy Hash: 051f6a827bce79c66d7d27af881ca03b03099689ff7baabf4a11b0fc079326c0
                                                            • Instruction Fuzzy Hash: 154107B5E01219AF8B14DFA9D8859DEBBF8EF08710F10416BFD18E7340E734A9408B99
                                                            Function 0049159E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 117stringregistryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 004915DA
                                                            • lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 0049163C
                                                            • lstrlenW.KERNEL32(?), ref: 00491648
                                                            • RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 0049168B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen$Value
                                                            • String ID: @fK$@fK$BundleUpgradeCode$regutil.cpp
                                                            • API String ID: 198323757-771501363
                                                            • Opcode ID: 0d404fa4354b4c697395453d913ffa31d06fab11ca75c0debf73149e0563af6e
                                                            • Instruction ID: e62acf49c551d8bc7ce3e0f03ba6c355b04e5223560b2fab6f168197e090df47
                                                            • Opcode Fuzzy Hash: 0d404fa4354b4c697395453d913ffa31d06fab11ca75c0debf73149e0563af6e
                                                            • Instruction Fuzzy Hash: AB416572D0062AAFDF11DF989D41AAE7B78EB44754F16017AFD11A7220C734ED118BA8
                                                            Function 00496C29 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,774CDFD0), ref: 00496C88
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00496CA5
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496CE3
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496D27
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$CompareFree
                                                            • String ID: email$name$uri
                                                            • API String ID: 3589242889-1168628755
                                                            • Opcode ID: aff5ec965c7e899026e1071276094003a2d8ba90e19fa0fae2bf68f665c0393b
                                                            • Instruction ID: f68c394ff15d164347d04f5f9f9b12661827439cab365cb706e151bde9720798
                                                            • Opcode Fuzzy Hash: aff5ec965c7e899026e1071276094003a2d8ba90e19fa0fae2bf68f665c0393b
                                                            • Instruction Fuzzy Hash: 02416F31A01219BBCF15DB94CD45FAEBB74EF04725F2242B6F920AB290C7399E00DB94
                                                            Function 0045F451 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045F48A
                                                              • Part of subcall function 00454115: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?), ref: 00454123
                                                              • Part of subcall function 00454115: GetLastError.KERNEL32(?,0046A0E8,00000000,00000000,?,00000000,004553BD,00000000,?,?,0045D5B5,?,00000000,00000000), ref: 00454131
                                                            • lstrlenA.KERNEL32(0049B500,00000000,00000094,00000000,00000094,?,?,004604BF,swidtag,00000094,?,0049B518,004604BF,00000000,?,00000000), ref: 0045F4DD
                                                              • Part of subcall function 00494DB3: CreateFileW.KERNEL32(0049B500,40000000,00000001,00000000,00000002,00000080,00000000,004604BF,00000000,?,0045F4F4,?,00000080,0049B500,00000000), ref: 00494DCB
                                                              • Part of subcall function 00494DB3: GetLastError.KERNEL32(?,0045F4F4,?,00000080,0049B500,00000000,?,004604BF,?,00000094,?,?,?,?,?,00000000), ref: 00494DD8
                                                            Strings
                                                            • Failed to create regid folder: %ls, xrefs: 0045F525
                                                            • swidtag, xrefs: 0045F49D
                                                            • Failed to allocate regid file path., xrefs: 0045F535
                                                            • Failed to format tag folder path., xrefs: 0045F543
                                                            • Failed to write tag xml to file: %ls, xrefs: 0045F51B
                                                            • Failed to allocate regid folder path., xrefs: 0045F53C
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
                                                            • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
                                                            • API String ID: 904508749-1201533908
                                                            • Opcode ID: e4b0ce8f19ad84f55cb5cfef89e8bd4c41bb17f109b444c6d5f3ed8eca92e7d4
                                                            • Instruction ID: d226abb42e505b0a34c946edd2cb0bb4244d286a86e095714ce77270993bc187
                                                            • Opcode Fuzzy Hash: e4b0ce8f19ad84f55cb5cfef89e8bd4c41bb17f109b444c6d5f3ed8eca92e7d4
                                                            • Instruction Fuzzy Hash: 27319E31D01629BBCF119E94DC01B9EBBB4AF04711F204177FD00B6263E7789E49AB9A
                                                            Function 004653E2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,0045548E,00000000,00000000,?,00000000), ref: 0046548B
                                                            • GetLastError.KERNEL32(?,?,?,00454C61,?,?,00000000,?,?,?,?,?,?,0049B4A0,?,?), ref: 00465496
                                                            Strings
                                                            • pipe.cpp, xrefs: 004654BA
                                                            • Failed to write exit code to message buffer., xrefs: 00465406
                                                            • Failed to post terminate message to child process., xrefs: 00465476
                                                            • Failed to wait for child process exit., xrefs: 004654C4
                                                            • Failed to post terminate message to child process cache thread., xrefs: 0046545A
                                                            • Failed to write restart to message buffer., xrefs: 0046542E
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastObjectSingleWait
                                                            • String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
                                                            • API String ID: 1211598281-2161881128
                                                            • Opcode ID: 9e24dd3c4f9be23930b4ef81ef4736fb422bfc77613d6ec134e7358d4816abb7
                                                            • Instruction ID: ba49290dbd77f18424ce01c4b24a38611edd760f0737fe100f83104f23892d63
                                                            • Opcode Fuzzy Hash: 9e24dd3c4f9be23930b4ef81ef4736fb422bfc77613d6ec134e7358d4816abb7
                                                            • Instruction Fuzzy Hash: D421D732940A25BBCF125B91DC05F9E7768EB50725F2042A7F900B6190FB7CAD9096DE
                                                            Function 00469098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00469F04,00000003,000007D0,00000003,?,000007D0), ref: 004690B2
                                                            • GetLastError.KERNEL32(?,00469F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 004690BF
                                                            • CloseHandle.KERNEL32(00000000,?,00469F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 00469187
                                                            Strings
                                                            • Failed to verify catalog signature of payload: %ls, xrefs: 0046914E
                                                            • Failed to verify signature of payload: %ls, xrefs: 0046912F
                                                            • Failed to verify hash of payload: %ls, xrefs: 00469172
                                                            • Failed to open payload at path: %ls, xrefs: 00469103
                                                            • cache.cpp, xrefs: 004690F6
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorFileHandleLast
                                                            • String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
                                                            • API String ID: 2528220319-2757871984
                                                            • Opcode ID: a061b8166071259d4fd9618d47cca390862c71b612ae18323384beb018113054
                                                            • Instruction ID: ac17d5ec6479bfdf99f1fcea7185fac006a0ce2f1e75a5c33c20baacc0cbb608
                                                            • Opcode Fuzzy Hash: a061b8166071259d4fd9618d47cca390862c71b612ae18323384beb018113054
                                                            • Instruction Fuzzy Hash: B921F632540626B7EB321A548D4DBDB7A1CAF16760F304227FD0466290B3BD9C61DADF
                                                            Function 00456B1E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00456B69
                                                            • GetLastError.KERNEL32 ref: 00456B73
                                                            • GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00456BB7
                                                            • GetLastError.KERNEL32 ref: 00456BC1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$DirectoryNamePathVolumeWindows
                                                            • String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 124030351-4026719079
                                                            • Opcode ID: 1d3d0ad2d01efa7eed80444185af3febb0ec4cdaa2efd9d0278b179220bf7450
                                                            • Instruction ID: 6962f53c435a5ef2b2f2408529247d821e6d0dbe9aa1ceefc6e315993995b749
                                                            • Opcode Fuzzy Hash: 1d3d0ad2d01efa7eed80444185af3febb0ec4cdaa2efd9d0278b179220bf7450
                                                            • Instruction Fuzzy Hash: 6D21EA73E4123867DB20A7559D06F9F76AC9B00B11F12417BBE04F7242EA3CAD444AED
                                                            Function 00459C6D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459C88
                                                            • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,000002C0,?,0045A895,00000100,000002C0,000002C0,?,000002C0), ref: 00459CA0
                                                            • GetLastError.KERNEL32(?,0045A895,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00459CAB
                                                            Strings
                                                            • Failed to format variable string., xrefs: 00459C93
                                                            • search.cpp, xrefs: 00459CDB
                                                            • Failed get to file attributes. '%ls', xrefs: 00459CE8
                                                            • Failed to set variable., xrefs: 00459D2B
                                                            • File search: %ls, did not find path: %ls, xrefs: 00459CFD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileLastOpen@16
                                                            • String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
                                                            • API String ID: 1811509786-2053429945
                                                            • Opcode ID: e977fafa149fc7e2beee1c6814eb7301ae26747dfd461928dd1e47179a964e70
                                                            • Instruction ID: b5647dfe2531a35d277969407156b1b67d006ed2cd92ad7aa8132fe6eaf481e4
                                                            • Opcode Fuzzy Hash: e977fafa149fc7e2beee1c6814eb7301ae26747dfd461928dd1e47179a964e70
                                                            • Instruction Fuzzy Hash: 33217933940124FADF125A968D42FAEBB64DF11763F200277FD0476192D72C5D08A2DD
                                                            Function 0046AD40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • TlsSetValue.KERNEL32(?,?), ref: 0046AD57
                                                            • GetLastError.KERNEL32 ref: 0046AD61
                                                            • CoInitializeEx.OLE32(00000000,00000000), ref: 0046ADA0
                                                            • CoUninitialize.OLE32(?,0046C721,?,?), ref: 0046ADDD
                                                            Strings
                                                            • Failed to initialize COM., xrefs: 0046ADAC
                                                            • Failed to pump messages in child process., xrefs: 0046ADCB
                                                            • Failed to set elevated cache pipe into thread local storage for logging., xrefs: 0046AD8F
                                                            • elevation.cpp, xrefs: 0046AD85
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorInitializeLastUninitializeValue
                                                            • String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
                                                            • API String ID: 876858697-113251691
                                                            • Opcode ID: 03b98e44493b0e54660d500a2a5ab9478718aae9f15bf1713146b39564b1e7ad
                                                            • Instruction ID: 98e07339a9dd62bbeb7ba32d4cfcfa1b82d462425a641c9f7c46d06e4bdca3cf
                                                            • Opcode Fuzzy Hash: 03b98e44493b0e54660d500a2a5ab9478718aae9f15bf1713146b39564b1e7ad
                                                            • Instruction Fuzzy Hash: 61113A72941935BB87215755DC0599FBE68EF15B62711012BFC00B7610FB38AD108ADF
                                                            Function 00455CE2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00455D68
                                                              • Part of subcall function 004910B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0049112B
                                                              • Part of subcall function 004910B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00491163
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$Close
                                                            • String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
                                                            • API String ID: 1979452859-3209209246
                                                            • Opcode ID: 0d35e2d7b7b847e1479d92f80da51b60ba0eb851c76735895086b5a73c795823
                                                            • Instruction ID: c1f194a30e6d8482ad422e12c1f20693e136764e0cbb5f3403ef8cdaaeb02808
                                                            • Opcode Fuzzy Hash: 0d35e2d7b7b847e1479d92f80da51b60ba0eb851c76735895086b5a73c795823
                                                            • Instruction Fuzzy Hash: F4012633D40528BBCF1256949C0AE6E7F68CF00B21F248177FC0066222977D8E18C28D
                                                            Function 0048A20B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,y4H,00483479,?,?,?,0048A45C,00000001,00000001,ECE85006), ref: 0048A265
                                                            • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0048A45C,00000001,00000001,ECE85006,?,?,?), ref: 0048A2EB
                                                            • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,ECE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0048A3E5
                                                            • __freea.LIBCMT ref: 0048A3F2
                                                              • Part of subcall function 0048521A: HeapAlloc.KERNEL32(00000000,?,?,?,00481F87,?,0000015D,?,?,?,?,004833E0,000000FF,00000000,?,?), ref: 0048524C
                                                            • __freea.LIBCMT ref: 0048A3FB
                                                            • __freea.LIBCMT ref: 0048A420
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ByteCharMultiWide__freea$AllocHeap
                                                            • String ID: y4H
                                                            • API String ID: 3147120248-1733079192
                                                            • Opcode ID: d542b1716c4c90039fe842e715ce634a77123c9df3ca100066d0bced0f2cf2cc
                                                            • Instruction ID: 2e4745793e3171e5be84cfa654358067d8784216f7dceb863801d888763da8b4
                                                            • Opcode Fuzzy Hash: d542b1716c4c90039fe842e715ce634a77123c9df3ca100066d0bced0f2cf2cc
                                                            • Instruction Fuzzy Hash: BD510532610216AFEB25AE65CC41EBF77A9EB44750F144A6FFC04D6240DBB8DCA0C75A
                                                            Function 0047A271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 0047A33E
                                                            • GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 0047A348
                                                            Strings
                                                            • download, xrefs: 0047A308
                                                            • :, xrefs: 0047A3C1
                                                            • apply.cpp, xrefs: 0047A36C
                                                            • Failed attempt to download URL: '%ls' to: '%ls', xrefs: 0047A425
                                                            • Failed to clear readonly bit on payload destination path: %ls, xrefs: 0047A377
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileLast
                                                            • String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
                                                            • API String ID: 1799206407-1905830404
                                                            • Opcode ID: bcafe1aa1498095a822557e2a8d17af69425b96e8d45647d1c827f55ca4d846b
                                                            • Instruction ID: 2ce289f018f525aa08bd3940f31532118141cece0157ee094bbfe517bc42a541
                                                            • Opcode Fuzzy Hash: bcafe1aa1498095a822557e2a8d17af69425b96e8d45647d1c827f55ca4d846b
                                                            • Instruction Fuzzy Hash: 1F517071A00215ABDB11DFA5C845AEEB7B4FF54710F10C16AE808EB351E379DE50CB9A
                                                            Function 00496EFF Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,774CDFD0,000000FF,type,000000FF,?,774CDFD0,774CDFD0,774CDFD0), ref: 00496F55
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00496FA0
                                                            • SysFreeString.OLEAUT32(00000000), ref: 0049701C
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497068
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$Free$Compare
                                                            • String ID: type$url
                                                            • API String ID: 1324494773-1247773906
                                                            • Opcode ID: e7ed00e93c646808dcfbfe3d54291d567d25516b25e035edab8f5e2caa02146b
                                                            • Instruction ID: f7244b32bbc443b768434cbb2920a9ca1be5719aff17aaa1551e990cf50bf193
                                                            • Opcode Fuzzy Hash: e7ed00e93c646808dcfbfe3d54291d567d25516b25e035edab8f5e2caa02146b
                                                            • Instruction Fuzzy Hash: 4A517D31915219EFCF15DFA4C944EAEBFB8EF04711F1142BAE911AB2A0D7399E00DB94
                                                            Function 004984C7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00479063,000002C0,00000100), ref: 004984F5
                                                            • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00479063,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00498510
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareHeapString$AllocateProcess
                                                            • String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
                                                            • API String ID: 2664528157-4206478990
                                                            • Opcode ID: 71e64f831f51dadc60b9c6f52be4f143bce6bcb70511ad7f138b97c8ae0f3de8
                                                            • Instruction ID: 4d7633c37c846de1daeac8a4a790ca8a7a869078c6dee8604d98eaae5afc12cf
                                                            • Opcode Fuzzy Hash: 71e64f831f51dadc60b9c6f52be4f143bce6bcb70511ad7f138b97c8ae0f3de8
                                                            • Instruction Fuzzy Hash: 2D51A071644301BBDF209E19CD82F1A7FA5AB01760F21812EF965AF2D2DB78ED008B5C
                                                            Function 004964B7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32 ref: 00496513
                                                            • DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 0049660A
                                                            • CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00496619
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseDeleteErrorFileHandleLast
                                                            • String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
                                                            • API String ID: 3522763407-1704223933
                                                            • Opcode ID: 30e46d2cc0f2a3d621ef5084b799f969b3236a85bf4ca1e0d3ca18c7e3c1fd45
                                                            • Instruction ID: a5ce70878c0a77f27a1f356b756d2a7b61fa619b3208c451efa2dba15d8ecd74
                                                            • Opcode Fuzzy Hash: 30e46d2cc0f2a3d621ef5084b799f969b3236a85bf4ca1e0d3ca18c7e3c1fd45
                                                            • Instruction Fuzzy Hash: 5F514972D00119BBDF12DFA48C45EEFBFB9EB08710F124166FA14E6150E7399E119BA8
                                                            Function 00459EC7 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459EED
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459F12
                                                            Strings
                                                            • MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 0045A006
                                                            • Failed to format product code string., xrefs: 00459F1D
                                                            • Failed to format component id string., xrefs: 00459EF8
                                                            • Failed to get component path: %d, xrefs: 00459F76
                                                            • Failed to set variable., xrefs: 00459FF6
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16
                                                            • String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
                                                            • API String ID: 3613110473-1671347822
                                                            • Opcode ID: e27e318c000c7947c26a2a6e4b9caa5df81dcafaac067d2404d9020999d84845
                                                            • Instruction ID: f64bd175f7f282db3442b588a3da2462b75b08342c0281ec5efdd758fe815311
                                                            • Opcode Fuzzy Hash: e27e318c000c7947c26a2a6e4b9caa5df81dcafaac067d2404d9020999d84845
                                                            • Instruction Fuzzy Hash: B041C633900115FACF259AA98C46BAE7A68AB04312F244267FD14E2292D7389D58D75E
                                                            Function 0045F812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0045F942
                                                            • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0045F94F
                                                            Strings
                                                            • %ls.RebootRequired, xrefs: 0045F82F
                                                            • Resume, xrefs: 0045F8B6
                                                            • Failed to format pending restart registry key to read., xrefs: 0045F846
                                                            • Failed to open registration key., xrefs: 0045F8AB
                                                            • Failed to read Resume value., xrefs: 0045F8D8
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close
                                                            • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                            • API String ID: 3535843008-3890505273
                                                            • Opcode ID: 684e106f8583413905b59a049150c7b87297fbfdf5a9438df1b50225777a61fe
                                                            • Instruction ID: e5c9bbd85ea1ff643936288daaa8a28666f34c7ac04f2f1c1211b110da415b99
                                                            • Opcode Fuzzy Hash: 684e106f8583413905b59a049150c7b87297fbfdf5a9438df1b50225777a61fe
                                                            • Instruction Fuzzy Hash: B6416FB1900519FFCF119F98C840BADBBA4EB04315F154177EC10A7262C3799E49DB4A
                                                            Function 0046AA00 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
                                                            • API String ID: 0-660234312
                                                            • Opcode ID: 46bc68cd860b2da8e7d99db96e0ef64a23da5b6e7703680f871d7a98fc12e4fb
                                                            • Instruction ID: 3cb179f7831d97cb46526b98cd8f35629036b11fd049623e833706f647c4c8e0
                                                            • Opcode Fuzzy Hash: 46bc68cd860b2da8e7d99db96e0ef64a23da5b6e7703680f871d7a98fc12e4fb
                                                            • Instruction Fuzzy Hash: C3311832900519BFCF229AD4CD01F9E7B79DB01720F214267F810B6291EB749D50CA9A
                                                            Function 0047D8B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CoCreateInstance.OLE32(004B0C4C,00000000,00000017,004B0C5C,?,?,00000000,00000000,?,?,?,?,?,0047DEE7,00000000,00000000), ref: 0047D8E8
                                                            Strings
                                                            • Failed to create BITS job., xrefs: 0047D922
                                                            • Failed to set notification flags for BITS job., xrefs: 0047D93A
                                                            • WixBurn, xrefs: 0047D913
                                                            • Failed to create IBackgroundCopyManager., xrefs: 0047D8F4
                                                            • Failed to set progress timeout., xrefs: 0047D952
                                                            • Failed to set BITS job to foreground., xrefs: 0047D969
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateInstance
                                                            • String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
                                                            • API String ID: 542301482-468763447
                                                            • Opcode ID: 75a1bc048ca5ba2bc1bc72cfb41ef2d9a01e7e811f2bc8a9c1a4778c37133f35
                                                            • Instruction ID: df1d13d4283307a8fb1d964c9f007d4291f082a34dfc9082dc1808333d6045f3
                                                            • Opcode Fuzzy Hash: 75a1bc048ca5ba2bc1bc72cfb41ef2d9a01e7e811f2bc8a9c1a4778c37133f35
                                                            • Instruction Fuzzy Hash: 3331C6B1F40315AF8B18DFA9C845EEFBBB4AF48711B10426BEA05EB350C6349C058799
                                                            Function 00495DAE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00495DF8
                                                            • GetLastError.KERNEL32 ref: 00495E05
                                                            • ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00495E4C
                                                            • GetLastError.KERNEL32 ref: 00495E80
                                                            • CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 00495EB4
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$CloseCreateHandleRead
                                                            • String ID: %ls.R$dlutil.cpp
                                                            • API String ID: 3160720760-657863730
                                                            • Opcode ID: 42b7a83544d5ddcc061f9a949540b45b527e909e091d323114eb3f450add9a8b
                                                            • Instruction ID: 70aa997203eff585743afe49ba1db43a1da3c94f0977b1ddac4c123bbbbc0cec
                                                            • Opcode Fuzzy Hash: 42b7a83544d5ddcc061f9a949540b45b527e909e091d323114eb3f450add9a8b
                                                            • Instruction Fuzzy Hash: 2D310172941624ABDF218B559C45BAF7EA4EB01721F21423BFE04AB2C0D3799E0087E8
                                                            Function 0045C8E6 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045CD5E: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,0045E444,000000FF,00000000,00000000,0045E444,?,?,0045DBEB,?,?,?,?), ref: 0045CD89
                                                            • CreateFileW.KERNEL32(E90049BA,80000000,00000005,00000000,00000003,08000000,00000000,004553C5,?,00000000,840F01E8,14680A79,00000001,004553BD,00000000,00455489), ref: 0045C956
                                                            • GetLastError.KERNEL32(?,?,?,00467809,0045566D,00455479,00455479,00000000,?,00455489,FFF9E89D,00455489,004554BD,00455445,?,00455445), ref: 0045C99B
                                                            Strings
                                                            • Failed to open catalog in working path: %ls, xrefs: 0045C9C9
                                                            • Failed to get catalog local file path, xrefs: 0045C9D9
                                                            • Failed to find payload for catalog file., xrefs: 0045C9E0
                                                            • catalog.cpp, xrefs: 0045C9BC
                                                            • Failed to verify catalog signature: %ls, xrefs: 0045C994
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareCreateErrorFileLastString
                                                            • String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
                                                            • API String ID: 1774366664-48089280
                                                            • Opcode ID: 8e6279203b02758e4bfeabc5a8a6b04718542544401bf058db5c304609e63bd9
                                                            • Instruction ID: d427052abafaa7e202a8980155c19a69131a0afae5e0a3835fa9739f73a6e164
                                                            • Opcode Fuzzy Hash: 8e6279203b02758e4bfeabc5a8a6b04718542544401bf058db5c304609e63bd9
                                                            • Instruction Fuzzy Hash: 9F31F5B2940725BFCB209B55CC82B5EBBA4EF04721F21416BFD04EB241E678AD148BD8
                                                            Function 0047D33E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(?,000000FF,774D30B0,00000000,?,?,?,?,0047D642,?), ref: 0047D357
                                                            • ReleaseMutex.KERNEL32(?,?,?,?,0047D642,?), ref: 0047D375
                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0047D3B6
                                                            • ReleaseMutex.KERNEL32(?), ref: 0047D3CD
                                                            • SetEvent.KERNEL32(?), ref: 0047D3D6
                                                            Strings
                                                            • Failed to send files in use message from netfx chainer., xrefs: 0047D41C
                                                            • Failed to get message from netfx chainer., xrefs: 0047D3F7
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: MutexObjectReleaseSingleWait$Event
                                                            • String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
                                                            • API String ID: 2608678126-3424578679
                                                            • Opcode ID: 108473c6cb486551c8206e253a080600d70b5c38890999f7a17f6a01a75ce871
                                                            • Instruction ID: 594e1bb516142b52ef64c7d6a3ab0e097c4c593570e4da20e5d60ffba1bcfa79
                                                            • Opcode Fuzzy Hash: 108473c6cb486551c8206e253a080600d70b5c38890999f7a17f6a01a75ce871
                                                            • Instruction Fuzzy Hash: C931D531900609BFCB129F94DC08EEFBBF4EF54321F10866BF965A2261C734A9508B94
                                                            Function 0049093B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 004909AB
                                                            • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 004909B5
                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 004909FE
                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00490A0B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$CreateErrorLastProcess
                                                            • String ID: "%ls" %ls$D$procutil.cpp
                                                            • API String ID: 161867955-2732225242
                                                            • Opcode ID: 9ebc60c5c82817306076271a067eb5a18080285730365cce878f7fe529fcff55
                                                            • Instruction ID: 15d39eb6bc0ea7a3c690b017a25f60131a265bf201dbb7778769d4eac133e12d
                                                            • Opcode Fuzzy Hash: 9ebc60c5c82817306076271a067eb5a18080285730365cce878f7fe529fcff55
                                                            • Instruction Fuzzy Hash: A52149B2D4021EAFDF11DFA5D941AAFBBB8EF00754F10003AEA04B6211D3749E009AE9
                                                            Function 00459B9A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459BB3
                                                            • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,0045A8AB,00000100,000002C0,000002C0,00000100), ref: 00459BD3
                                                            • GetLastError.KERNEL32(?,0045A8AB,00000100,000002C0,000002C0,00000100), ref: 00459BDE
                                                            Strings
                                                            • Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00459C4A
                                                            • Failed to format variable string., xrefs: 00459BBE
                                                            • Failed to set directory search path variable., xrefs: 00459C0F
                                                            • Failed while searching directory search: %ls, for path: %ls, xrefs: 00459C34
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileLastOpen@16
                                                            • String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
                                                            • API String ID: 1811509786-2966038646
                                                            • Opcode ID: 137cd395983456b2637c20d7ea6f2b40305bd5676ea8d218afc60ce3909665f2
                                                            • Instruction ID: b59620a26ffa59e01aafdd9ea193b0c2cec76a3265c168471c66c73a519d10e2
                                                            • Opcode Fuzzy Hash: 137cd395983456b2637c20d7ea6f2b40305bd5676ea8d218afc60ce3909665f2
                                                            • Instruction Fuzzy Hash: B6212633940021FBCF23669A9D02B5EBF68AF00722F200267FE1076152D72D5E54A6CE
                                                            Function 00459D4B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459D64
                                                            • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,0045A883,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00459D84
                                                            • GetLastError.KERNEL32(?,0045A883,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00459D8F
                                                            Strings
                                                            • Failed while searching file search: %ls, for path: %ls, xrefs: 00459DBD
                                                            • Failed to format variable string., xrefs: 00459D6F
                                                            • Failed to set variable to file search path., xrefs: 00459DE7
                                                            • File search: %ls, did not find path: %ls, xrefs: 00459DF3
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileLastOpen@16
                                                            • String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
                                                            • API String ID: 1811509786-3425311760
                                                            • Opcode ID: 0aebc702ad33bfb4a46d96253f1370a59b610a4ccdccea27f567e0078d7f5662
                                                            • Instruction ID: 6bc5b74a293ef58e32349392ba46ef30763cf82fe2ba282158a7b1a3bfd559ae
                                                            • Opcode Fuzzy Hash: 0aebc702ad33bfb4a46d96253f1370a59b610a4ccdccea27f567e0078d7f5662
                                                            • Instruction Fuzzy Hash: 53110833840125FBDF12A6D5CD03B9EBA359F10726F200267FD10761A2E7395E18A6DD
                                                            Function 0046CF25 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?), ref: 0046CF37
                                                            • GetLastError.KERNEL32(?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0046CF41
                                                            • GetExitCodeThread.KERNEL32(00000001,?,?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?,00000000), ref: 0046CF7D
                                                            • GetLastError.KERNEL32(?,?,0046D365,00000000,?,?,0046C7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0046CF87
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                            • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
                                                            • API String ID: 3686190907-1954264426
                                                            • Opcode ID: ab4aca07ab0f2e804a1c58bf26b487cdb3ffce9e89a97d98869b9904274ddebf
                                                            • Instruction ID: a3b9360dcf6d2105c8eace776ec71d263cd015a933830bc3f70a071e4bbb8cb5
                                                            • Opcode Fuzzy Hash: ab4aca07ab0f2e804a1c58bf26b487cdb3ffce9e89a97d98869b9904274ddebf
                                                            • Instruction Fuzzy Hash: E3018973A802356387345B865D09A6F7A88DF10BA1B02017BBE44BB2C0F71C9D0081EE
                                                            Function 004669AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00466EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 004669BB
                                                            • GetLastError.KERNEL32(?,00466EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 004669C5
                                                            • GetExitCodeThread.KERNEL32(00000001,00000000,?,00466EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00466A04
                                                            • GetLastError.KERNEL32(?,00466EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 00466A0E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                            • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
                                                            • API String ID: 3686190907-2546940223
                                                            • Opcode ID: 108d67e92e39dd16ba1b4b191008aba4494f6fc7e1aafb326259e25f6123e928
                                                            • Instruction ID: cfbfe45cff779bf00ed9a090171c56cb97aa7d741fab8e9434d56bf77c8ad14a
                                                            • Opcode Fuzzy Hash: 108d67e92e39dd16ba1b4b191008aba4494f6fc7e1aafb326259e25f6123e928
                                                            • Instruction Fuzzy Hash: 9311A970740206BBEB00DFA19E05B6F36A8EB50751F21417BBD04E9150FB39CE00975D
                                                            Function 0046AB9E Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 140COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(yTE,000000FF,00AAC56B,E90049BA,004553BD,00000000,?,E90049BA,00000000), ref: 0046AC94
                                                            • GetLastError.KERNEL32(00000000,00000000,00000000,00000000,yTE,000000FF,00AAC56B,E90049BA,004553BD,00000000,?,E90049BA,00000000), ref: 0046ACD8
                                                            Strings
                                                            • yTE, xrefs: 0046AC88
                                                            • Failed to verify expected payload against actual certificate chain., xrefs: 0046AD1E
                                                            • Failed to get signer chain from authenticode certificate., xrefs: 0046AD06
                                                            • Failed authenticode verification of payload: %ls, xrefs: 0046AC75
                                                            • Failed to get provider state from authenticode certificate., xrefs: 0046ACC2
                                                            • cache.cpp, xrefs: 0046AC6A, 0046ACB8, 0046ACFC
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast
                                                            • String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp$yTE
                                                            • API String ID: 1452528299-14144228
                                                            • Opcode ID: 2c77ffcbc0e69d864784e86089375a526d425a4be794c76584334a979d6db0e7
                                                            • Instruction ID: 196a79fc449da7bb35fae4d78e3851de75d10914db0a1759efe9db6183fae238
                                                            • Opcode Fuzzy Hash: 2c77ffcbc0e69d864784e86089375a526d425a4be794c76584334a979d6db0e7
                                                            • Instruction Fuzzy Hash: 0D41B572D40628ABDB109B95CC45ADFBBB8EF04764F11012BFD00B7281E7785D048AEA
                                                            Function 0046F7D9 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 0046F7EE
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0046F8FB
                                                            Strings
                                                            • Failed to set source path for payload., xrefs: 0046F88A
                                                            • Engine is active, cannot change engine state., xrefs: 0046F808
                                                            • UX requested unknown container with id: %ls, xrefs: 0046F8BA
                                                            • UX denied while trying to set source on embedded payload: %ls, xrefs: 0046F870
                                                            • Failed to set source path for container., xrefs: 0046F8E0
                                                            • UX requested unknown payload with id: %ls, xrefs: 0046F85A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                            • API String ID: 3168844106-4121889706
                                                            • Opcode ID: ac2df2a3f5eff671624af3cc78ce49c06e86be7f1ff0acbb588f783aa8b2f893
                                                            • Instruction ID: b35360b5b9286067f0501fc3c62c424116bc97fe8eba0a845e32bfd925b2f590
                                                            • Opcode Fuzzy Hash: ac2df2a3f5eff671624af3cc78ce49c06e86be7f1ff0acbb588f783aa8b2f893
                                                            • Instruction Fuzzy Hash: 00310532A00611AF8B21AB59EC45E5B77ACEF64720B2540BBF840E7341FB7CDD14879A
                                                            Function 004571FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(00000000), ref: 00457210
                                                            Strings
                                                            • Failed to append characters., xrefs: 0045729C
                                                            • []{}, xrefs: 0045723A
                                                            • Failed to copy string., xrefs: 004572C4
                                                            • Failed to append escape sequence., xrefs: 004572A3
                                                            • Failed to format escape sequence., xrefs: 004572AA
                                                            • [\%c], xrefs: 0045726F
                                                            • Failed to allocate buffer for escaped string., xrefs: 00457227
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen
                                                            • String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
                                                            • API String ID: 1659193697-3250950999
                                                            • Opcode ID: fc512e8785fd6f55d1a5eebfdffec0b9adcb80a6b515f7964905d8f1a7ae7c74
                                                            • Instruction ID: 7395690f425bc40b54f03c62ec5c7f1f4ca089f864fe3fe787ab76d319a36cc0
                                                            • Opcode Fuzzy Hash: fc512e8785fd6f55d1a5eebfdffec0b9adcb80a6b515f7964905d8f1a7ae7c74
                                                            • Instruction Fuzzy Hash: D621F732908619BBDF215690AC46FAE7F699F10726F2001BBFD00B6192DB7C5E0992DD
                                                            Function 00475BDC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(00000000,00000000,0049B500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,004767DE,?,00000001,?,0049B4A0), ref: 00475C45
                                                            Strings
                                                            • feclient.dll, xrefs: 00475C3B, 00475D65
                                                            • Failed to insert execute action., xrefs: 00475C9A
                                                            • Failed to copy target product code., xrefs: 00475D78
                                                            • Failed grow array of ordered patches., xrefs: 00475CDE
                                                            • Failed to plan action for target product., xrefs: 00475CF0
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
                                                            • API String ID: 1825529933-3477540455
                                                            • Opcode ID: 98e8d04084b4ee1c45552d832d8757f11b974cf766916698516baee93b2b8131
                                                            • Instruction ID: 751e14f00bc75da91f11bd70a120258727b56724c82d3bc29cf6ab8a4780f0bb
                                                            • Opcode Fuzzy Hash: 98e8d04084b4ee1c45552d832d8757f11b974cf766916698516baee93b2b8131
                                                            • Instruction Fuzzy Hash: 5F8136B660074ADFCB15CF58C880AAA77A4FF08324F11856AED199B352D774ED11CF94
                                                            Function 0048CAED Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0048D262,00000000,00000000,00000000,00000000,00000000,00482F1D), ref: 0048CB2F
                                                            • __fassign.LIBCMT ref: 0048CBAA
                                                            • __fassign.LIBCMT ref: 0048CBC5
                                                            • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0048CBEB
                                                            • WriteFile.KERNEL32(?,00000000,00000000,0048D262,00000000,?,?,?,?,?,?,?,?,?,0048D262,00000000), ref: 0048CC0A
                                                            • WriteFile.KERNEL32(?,00000000,00000001,0048D262,00000000,?,?,?,?,?,?,?,?,?,0048D262,00000000), ref: 0048CC43
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                            • String ID:
                                                            • API String ID: 1324828854-0
                                                            • Opcode ID: 54c17def165951e6e5a58a946b68621c57d0d16d682855f3435384b6d8712773
                                                            • Instruction ID: b658886fa85cb7107642989a6f04a998b0d25c55e3f5cb69d842995525b4d5bb
                                                            • Opcode Fuzzy Hash: 54c17def165951e6e5a58a946b68621c57d0d16d682855f3435384b6d8712773
                                                            • Instruction Fuzzy Hash: 8C51F371A002499FDB10DFA8DD85AEEBBF8FF09300F14452BE955E7251E734A941CBA8
                                                            Function 00479279 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00467113,000000B8,0000001C,00000100), ref: 004792A4
                                                            • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,0049B4B8,000000FF,?,?,?,00467113,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 0047932E
                                                            Strings
                                                            • comres.dll, xrefs: 004793B0
                                                            • BA aborted detect forward compatible bundle., xrefs: 00479398
                                                            • detect.cpp, xrefs: 0047938E
                                                            • Failed to initialize update bundle., xrefs: 004793D1
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
                                                            • API String ID: 1825529933-439563586
                                                            • Opcode ID: 9dc3a60abd19c6258c6e102fc6954586cfee9609312d6542b03da2c4c3df60fc
                                                            • Instruction ID: 93b64e55d3fbb83d7f259fd99bcf1bf02c51459e2898f2c8817b337a32113891
                                                            • Opcode Fuzzy Hash: 9dc3a60abd19c6258c6e102fc6954586cfee9609312d6542b03da2c4c3df60fc
                                                            • Instruction Fuzzy Hash: 9E51D470600211BBDF159F65CC81EEAB766FF05310F14826AF9289B291C739EC60CB99
                                                            Function 0046D437 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CloseHandle.KERNEL32(00000000,?,?,00000001,0049B500,?,00000001,000000FF,?,?,7707B390,00000000,00000001,00000000,?,004674E6), ref: 0046D560
                                                            Strings
                                                            • UX aborted elevation requirement., xrefs: 0046D475
                                                            • Failed to create pipe name and client token., xrefs: 0046D4A1
                                                            • Failed to elevate., xrefs: 0046D542
                                                            • Failed to create pipe and cache pipe., xrefs: 0046D4BD
                                                            • Failed to connect to elevated child process., xrefs: 0046D549
                                                            • elevation.cpp, xrefs: 0046D46B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle
                                                            • String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
                                                            • API String ID: 2962429428-3003415917
                                                            • Opcode ID: e734f5fbe7df5e0bf3ab743d2741eb5e54d9dd86f94e53a843fa49beff037065
                                                            • Instruction ID: 29d260c558ac0f3e7f4aa392ece292a664f966cfcd10e87bb521b5270cb60699
                                                            • Opcode Fuzzy Hash: e734f5fbe7df5e0bf3ab743d2741eb5e54d9dd86f94e53a843fa49beff037065
                                                            • Instruction Fuzzy Hash: 30313B72F447257AEB25A664CC46FBA775C9F00738F20421BF905AA181FA6DAD0082DF
                                                            Function 00490523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(004BB5FC,00000000,?,?,?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?), ref: 00490533
                                                            • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,004BB5F4,?,00464207,00000000,Setup), ref: 004905D7
                                                            • GetLastError.KERNEL32(?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?,?,?), ref: 004905E7
                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?), ref: 00490621
                                                              • Part of subcall function 00452DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00452F09
                                                            • LeaveCriticalSection.KERNEL32(004BB5FC,?,?,004BB5F4,?,00464207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,004554FA,?), ref: 0049067A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                            • String ID: logutil.cpp
                                                            • API String ID: 4111229724-3545173039
                                                            • Opcode ID: 531130dd7f5100a201db4f67500eeac06cc470bf696f939065cd4a40067a120d
                                                            • Instruction ID: 4818d0538aa59f58f9783101e4c69ae94e5ad1dc1592049279d4aa4240d2a729
                                                            • Opcode Fuzzy Hash: 531130dd7f5100a201db4f67500eeac06cc470bf696f939065cd4a40067a120d
                                                            • Instruction Fuzzy Hash: 6F31B431900219FFCF219F619D45F5A7E68EB40759F11023BF900A6161D7B8DD609BED
                                                            Function 0047398D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 004739F4
                                                            Strings
                                                            • Failed to escape string., xrefs: 00473A76
                                                            • %s%="%s", xrefs: 00473A27
                                                            • Failed to format property string part., xrefs: 00473A6F
                                                            • Failed to append property string part., xrefs: 00473A68
                                                            • Failed to format property value., xrefs: 00473A7D
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16
                                                            • String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
                                                            • API String ID: 3613110473-515423128
                                                            • Opcode ID: 46fbc03f3f5d7ebb20bccd26bd13c895d7e655376de56c9c2ed2ce5a4464a44c
                                                            • Instruction ID: 06ccdf603ece83d9f08927cb4bf3d2bca7ca876f29d49b2dd939b9dbc9d5cb72
                                                            • Opcode Fuzzy Hash: 46fbc03f3f5d7ebb20bccd26bd13c895d7e655376de56c9c2ed2ce5a4464a44c
                                                            • Instruction Fuzzy Hash: B331D2B2905219BFCB11DE98CC42AEEB768AF00706F10826BFD1562241D7799F14EB98
                                                            Function 004941E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,0049432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,0046A063,00000001), ref: 00494203
                                                            • GetLastError.KERNEL32(00000002,?,0049432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,0046A063,00000001,000007D0,00000001,00000001,00000003), ref: 00494212
                                                            • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,0049432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,0046A063,00000001), ref: 004942A6
                                                            • GetLastError.KERNEL32(?,0049432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,0046A063,00000001,000007D0,00000001), ref: 004942B0
                                                              • Part of subcall function 00494440: FindFirstFileW.KERNEL32(0047923A,?,00000100,00000000,00000000), ref: 0049447B
                                                              • Part of subcall function 00494440: FindClose.KERNEL32(00000000), ref: 00494487
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorFindLastMove$CloseFirst
                                                            • String ID: \$fileutil.cpp
                                                            • API String ID: 3479031965-1689471480
                                                            • Opcode ID: 68d40af6d8b58aed9b27badeed4ae48194eeb654da177ebe989aa6570706c322
                                                            • Instruction ID: eb86e6f6ea906b1c4dbf96fa59ab6613e6957930a5a196b82703a156f80528e1
                                                            • Opcode Fuzzy Hash: 68d40af6d8b58aed9b27badeed4ae48194eeb654da177ebe989aa6570706c322
                                                            • Instruction Fuzzy Hash: 2A31AB36A402269BDF215F95C800E6B7A69BBE17E0B2141BBFC009B210D3388D4283E9
                                                            Function 0045732C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00455932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 0045733E
                                                            • LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00455932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 0045741D
                                                            Strings
                                                            • Failed to get value as string for variable: %ls, xrefs: 0045740C
                                                            • Failed to get unformatted string., xrefs: 004573AE
                                                            • Failed to get variable: %ls, xrefs: 0045737F
                                                            • *****, xrefs: 004573D9, 004573E6
                                                            • Failed to format value '%ls' of variable: %ls, xrefs: 004573E7
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
                                                            • API String ID: 3168844106-2873099529
                                                            • Opcode ID: c6c80bdc318c343add3ce127ba35a883c8e0c0b577f14b373d7a5cc4e30b9981
                                                            • Instruction ID: 55281c2bde2435cfac6c22643411a2d405f5f1f5e5c69dc2fb7d49a48e0520ad
                                                            • Opcode Fuzzy Hash: c6c80bdc318c343add3ce127ba35a883c8e0c0b577f14b373d7a5cc4e30b9981
                                                            • Instruction Fuzzy Hash: 2B31BE3290462AFBCF215A40DC05B9E7E24EF14366F10813BFC0466212D37DAA58DBDD
                                                            Function 00468DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00468E37
                                                            • GetLastError.KERNEL32 ref: 00468E41
                                                            • SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00468EA1
                                                            Strings
                                                            • Failed to initialize ACL., xrefs: 00468E6F
                                                            • Failed to allocate administrator SID., xrefs: 00468E1D
                                                            • cache.cpp, xrefs: 00468E65
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileInitializeLast
                                                            • String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
                                                            • API String ID: 669721577-1117388985
                                                            • Opcode ID: 15e2aa6d9e6504c7a68ff8dc8860d0e008cf22fb364ced4a2825c4b0591302e5
                                                            • Instruction ID: d6aa40c131052fdeb1630a1f90e68b4f3526c7f372e05af8f5f9918cb252a37e
                                                            • Opcode Fuzzy Hash: 15e2aa6d9e6504c7a68ff8dc8860d0e008cf22fb364ced4a2825c4b0591302e5
                                                            • Instruction Fuzzy Hash: C721F632E40214B7DB209A959C45F9FB768AB50B10F11412FFD04FB280EA799D00869A
                                                            Function 00454212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00464028,00000001,feclient.dll,?,00000000,?,?,?,00454B12), ref: 0045424D
                                                            • GetLastError.KERNEL32(?,?,00464028,00000001,feclient.dll,?,00000000,?,?,?,00454B12,?,?,0049B488,?,00000001), ref: 00454259
                                                            • GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00464028,00000001,feclient.dll,?,00000000,?,?,?,00454B12,?), ref: 00454294
                                                            • GetLastError.KERNEL32(?,?,00464028,00000001,feclient.dll,?,00000000,?,?,?,00454B12,?,?,0049B488,?,00000001), ref: 0045429E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentDirectoryErrorLast
                                                            • String ID: crypt32.dll$dirutil.cpp
                                                            • API String ID: 152501406-1104880720
                                                            • Opcode ID: 7e9359fed3753bca19056eed647f756df70053d472fc5171e843f2aca183b580
                                                            • Instruction ID: f3c7637d03da81f4d673f45feaf6a8eefdae59be9ea0a052e869e19d167e63e4
                                                            • Opcode Fuzzy Hash: 7e9359fed3753bca19056eed647f756df70053d472fc5171e843f2aca183b580
                                                            • Instruction Fuzzy Hash: B9112B37E01637A787209AD64D4461BBA68EF457EAF1101BBFD04EF302E728DC4446E8
                                                            Function 00470B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            • Unexpected call to CabWrite()., xrefs: 00470BC1
                                                            • cabextract.cpp, xrefs: 00470C2B
                                                            • Failed to write during cabinet extraction., xrefs: 00470C35
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastWrite_memcpy_s
                                                            • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                            • API String ID: 1970631241-3111339858
                                                            • Opcode ID: 01db1aa24a3e6cae760b00e19555cd0ffb511b7a8895dee5d24fb039d977e23c
                                                            • Instruction ID: edb1c6eb2a2a3385b8cb4b326fd245054d1cf80424e25e565e7738f0f8d5c357
                                                            • Opcode Fuzzy Hash: 01db1aa24a3e6cae760b00e19555cd0ffb511b7a8895dee5d24fb039d977e23c
                                                            • Instruction Fuzzy Hash: 0421F276500200EFCB15CF5DD985D9A37A9EF84324B21815AFE08C7346E735ED10C769
                                                            Function 00459AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459AFB
                                                            • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,00000000,?,0045A8B4,00000100,000002C0,000002C0,00000100), ref: 00459B10
                                                            • GetLastError.KERNEL32(?,0045A8B4,00000100,000002C0,000002C0,00000100), ref: 00459B1B
                                                            Strings
                                                            • Failed to format variable string., xrefs: 00459B06
                                                            • Failed while searching directory search: %ls, for path: %ls, xrefs: 00459B54
                                                            • Failed to set variable., xrefs: 00459B7A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesErrorFileLastOpen@16
                                                            • String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
                                                            • API String ID: 1811509786-402580132
                                                            • Opcode ID: ff86371492954aa0cf3026cd4c5db1caffecef89cc6192163ac5b66592a703ee
                                                            • Instruction ID: d69855f49b3c2c8e7a7f8466aab61994a23a3809c57d9a25f329f5d89cf7c409
                                                            • Opcode Fuzzy Hash: ff86371492954aa0cf3026cd4c5db1caffecef89cc6192163ac5b66592a703ee
                                                            • Instruction Fuzzy Hash: F9113A32940125FBEF115695AD42F6EBA29FF00366F200327FE10B615287296D14A2CD
                                                            Function 00470C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00470CC4
                                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00470CD6
                                                            • SetFileTime.KERNEL32(?,?,?,?), ref: 00470CE9
                                                            • CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,004708B1,?,?), ref: 00470CF8
                                                            Strings
                                                            • cabextract.cpp, xrefs: 00470C93
                                                            • Invalid operation for this state., xrefs: 00470C9D
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Time$File$CloseDateHandleLocal
                                                            • String ID: Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 609741386-1751360545
                                                            • Opcode ID: cac86d6184dc5d28c8480a750368bfb27b71d3983a3f36ba603ebaf234884b96
                                                            • Instruction ID: c39bc5a99de92c7883b0053fda0e4d7c52ee4fa8bae0789607eefe59c9284926
                                                            • Opcode Fuzzy Hash: cac86d6184dc5d28c8480a750368bfb27b71d3983a3f36ba603ebaf234884b96
                                                            • Instruction Fuzzy Hash: B021C671801219EF87249FA8DD099FB7BACFF047207508267F858D6690D378E951CBD8
                                                            Function 00464A77 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,crypt32.dll,00000000,00000000,00000000,?,0046539D), ref: 00464AC3
                                                            Strings
                                                            • Failed to allocate message to write., xrefs: 00464AA2
                                                            • pipe.cpp, xrefs: 00464AFB
                                                            • crypt32.dll, xrefs: 00464A7D
                                                            • Failed to write message type to pipe., xrefs: 00464B05
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FileWrite
                                                            • String ID: Failed to allocate message to write.$Failed to write message type to pipe.$crypt32.dll$pipe.cpp
                                                            • API String ID: 3934441357-606776022
                                                            • Opcode ID: 1237cfcb41fe5a9ec88bdab719e1c3f008a32d2a51323d78b40636c9ed4c35a5
                                                            • Instruction ID: 198da5fa8587888253a809ff5d172bffff20949fcbcdcebbe2714a32bb544767
                                                            • Opcode Fuzzy Hash: 1237cfcb41fe5a9ec88bdab719e1c3f008a32d2a51323d78b40636c9ed4c35a5
                                                            • Instruction Fuzzy Hash: 9211A232940119BBCF11DF85DD05ADF7BA8EF81751F114067FD00B6240E778AE50D6AA
                                                            Function 00464642 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • _memcpy_s.LIBCMT ref: 00464693
                                                            • _memcpy_s.LIBCMT ref: 004646A6
                                                            • _memcpy_s.LIBCMT ref: 004646C1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _memcpy_s$Heap$AllocateProcess
                                                            • String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
                                                            • API String ID: 886498622-766083570
                                                            • Opcode ID: 827befee7b47cbd403ca212ad21118a66c13644948308149b39c9d7f69036fae
                                                            • Instruction ID: f9289a3d7a2507493bfa6025a97d7141abf077de7c8e884c77d640f547fac359
                                                            • Opcode Fuzzy Hash: 827befee7b47cbd403ca212ad21118a66c13644948308149b39c9d7f69036fae
                                                            • Instruction Fuzzy Hash: F911C1B210020AABCB00EE95CC82DDB73ACEF45B15B00052BFA008B142E779E65487E5
                                                            Function 004545ED Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00454617
                                                            • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 0045461E
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00454628
                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00454678
                                                            • GetLastError.KERNEL32 ref: 00454682
                                                            • CloseHandle.KERNEL32(?), ref: 0045477D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastProcess$CloseCurrentHandleLookupOpenPrivilegeTokenValue
                                                            • String ID: Failed to get process token.$engine.cpp
                                                            • API String ID: 4232854991-1789768409
                                                            • Opcode ID: 14d62e5c8ea21ffb6981f8aa1ddd977368c77f1c60d16607a5e908ffbeec8571
                                                            • Instruction ID: 5c3ebc9d3e002e86324ab3640c5dcbb0caf01c07909b69d2400d86406e6013d0
                                                            • Opcode Fuzzy Hash: 14d62e5c8ea21ffb6981f8aa1ddd977368c77f1c60d16607a5e908ffbeec8571
                                                            • Instruction Fuzzy Hash: A8014832A00229AFDB10AFB5AD86AAFBF64EB45715F10013FFE01FB251D6394D4486D9
                                                            Function 00459A4D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00459AC4
                                                            Strings
                                                            • Failed to select condition node., xrefs: 00459A7B
                                                            • ETE, xrefs: 00459A4D
                                                            • Condition, xrefs: 00459A5F
                                                            • Failed to copy condition string from BSTR, xrefs: 00459AAE
                                                            • Failed to get Condition inner text., xrefs: 00459A94
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeString
                                                            • String ID: Condition$ETE$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.
                                                            • API String ID: 3341692771-3043989177
                                                            • Opcode ID: df7e1c7ff6414e70c7ab15e4ca4a34a2b0eec8022a4afb63e2c38abb9dd6e950
                                                            • Instruction ID: ac85016df5c79283081e52db01baed8178be5e0c10a517d1eed62dea480ffc34
                                                            • Opcode Fuzzy Hash: df7e1c7ff6414e70c7ab15e4ca4a34a2b0eec8022a4afb63e2c38abb9dd6e950
                                                            • Instruction Fuzzy Hash: 02118231941264FBCF129B90CD06FAEBB69EB01712F24416BFC00B6251DBB99E44D6A8
                                                            Function 004567AA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTempPathW.KERNEL32(00000104,?), ref: 004567E3
                                                            • GetLastError.KERNEL32 ref: 004567ED
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastPathTemp
                                                            • String ID: 4Mw$Failed to get temp path.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 1238063741-4272026285
                                                            • Opcode ID: 50080217301a4d45cd3f5e8bf5f3314de5ce7590deae058150382aa595cbd21f
                                                            • Instruction ID: 64cdc7f8e2b9b4c2ffa42f0bb7fcda25c0c3e993b3eef04099b68b716b6df2d1
                                                            • Opcode Fuzzy Hash: 50080217301a4d45cd3f5e8bf5f3314de5ce7590deae058150382aa595cbd21f
                                                            • Instruction Fuzzy Hash: 56012B72E4223867DB20FB555C06F9E77989B00715F11427BFD04F7282EA68AD0486ED
                                                            Function 004996CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                            • API String ID: 0-1718035505
                                                            • Opcode ID: a184ca6701f58841285cd463b10be42d7b387a3001a780b5fe5ab1b4212c7e6f
                                                            • Instruction ID: e5ff15bf73dc1ca2e2457ad46839b5f0e70abee6ba0b789f08ef52c75428f131
                                                            • Opcode Fuzzy Hash: a184ca6701f58841285cd463b10be42d7b387a3001a780b5fe5ab1b4212c7e6f
                                                            • Instruction Fuzzy Hash: C801F4716922229B4F200EAD6DD5AE73B88CB1139171501BFE461D3340EF9DCC45A6ED
                                                            Function 00490ACC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00455EB2,00000000), ref: 00490AE0
                                                            • GetProcAddress.KERNEL32(00000000), ref: 00490AE7
                                                            • GetLastError.KERNEL32(?,?,?,00455EB2,00000000), ref: 00490AFE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorHandleLastModuleProc
                                                            • String ID: IsWow64Process$kernel32$procutil.cpp
                                                            • API String ID: 4275029093-1586155540
                                                            • Opcode ID: db5a5b175ee448e6520e2f5a07b86988c226a80657a1734980246c20252b74db
                                                            • Instruction ID: 839cf38faef771b967d1c5bc402ab1f50ef99a0ded4cc920d07bff3f2ee08d29
                                                            • Opcode Fuzzy Hash: db5a5b175ee448e6520e2f5a07b86988c226a80657a1734980246c20252b74db
                                                            • Instruction Fuzzy Hash: CEF0A472A40229BB8B209BD5AD09E9FBE68EB10751B114177BD04A7240EB78ED00D7E8
                                                            Function 00469287 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32 ref: 004693C9
                                                              • Part of subcall function 004956CF: GetLastError.KERNEL32(?,?,0046933A,?,00000003,00000000,?), ref: 004956EE
                                                            Strings
                                                            • Failed to read certificate thumbprint., xrefs: 004693BD
                                                            • yTE, xrefs: 00469287
                                                            • Failed to find expected public key in certificate chain., xrefs: 0046938A
                                                            • Failed to get certificate public key identifier., xrefs: 004693F7
                                                            • cache.cpp, xrefs: 004693ED
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast
                                                            • String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp$yTE
                                                            • API String ID: 1452528299-1318083439
                                                            • Opcode ID: 2f932cae4fc0f775897705081aafbcb6e93eb9bf496de64542c835eb703c1a14
                                                            • Instruction ID: 0bd3f4af5bcebcf95d15cc743127ea943854165df97423b7850b75172bc6016f
                                                            • Opcode Fuzzy Hash: 2f932cae4fc0f775897705081aafbcb6e93eb9bf496de64542c835eb703c1a14
                                                            • Instruction Fuzzy Hash: CC416272A00215ABDB10DFA5C841AAEB7BCAB0C714F11416BFD05E7391E778ED40CBA9
                                                            Function 00468CAC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00468D18
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Sleep
                                                            • String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
                                                            • API String ID: 3472027048-398165853
                                                            • Opcode ID: 108ea076a63527993c516f8cd1d89e72b6483e360080e186ba390e5918de4d71
                                                            • Instruction ID: 28db160e4498f7642c4ea5737d9fefc781954f7dd486d9d88b62b387a8150898
                                                            • Opcode Fuzzy Hash: 108ea076a63527993c516f8cd1d89e72b6483e360080e186ba390e5918de4d71
                                                            • Instruction Fuzzy Hash: 9231E372940214BBDB12AA548C42BBF676C9F31755F11416FFD00B6282EA3C8D0052BF
                                                            Function 0046E956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • DefWindowProcW.USER32(?,00000082,?,?), ref: 0046E985
                                                            • SetWindowLongW.USER32(?,000000EB,00000000), ref: 0046E994
                                                            • SetWindowLongW.USER32(?,000000EB,?), ref: 0046E9A8
                                                            • DefWindowProcW.USER32(?,?,?,?), ref: 0046E9B8
                                                            • GetWindowLongW.USER32(?,000000EB), ref: 0046E9D2
                                                            • PostQuitMessage.USER32(00000000), ref: 0046EA31
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Window$Long$Proc$MessagePostQuit
                                                            • String ID:
                                                            • API String ID: 3812958022-0
                                                            • Opcode ID: f14145fd1295e375f94e3cf8ca92e3ae2e0dc0392a5bc19a59343c14c26151fd
                                                            • Instruction ID: 971f5bb04a6a87cf20c21a248b60c353c22216d3b94eb60d32db8b183c0e35c4
                                                            • Opcode Fuzzy Hash: f14145fd1295e375f94e3cf8ca92e3ae2e0dc0392a5bc19a59343c14c26151fd
                                                            • Instruction Fuzzy Hash: 5E210375100104FFDF119FA9DD08E6B3BA5FF54315F14422AF90A9A2A0D731DD10DB96
                                                            Function 0046C7C9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            • Unexpected elevated message sent to child process, msg: %u, xrefs: 0046C9C4
                                                            • Failed to save state., xrefs: 0046C891
                                                            • elevation.cpp, xrefs: 0046C9B8
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandleMutexRelease
                                                            • String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
                                                            • API String ID: 4207627910-1576875097
                                                            • Opcode ID: c7e7795c5340e552953f02e34a8312dadeb5ff5321eb8b45fc04f055557940f6
                                                            • Instruction ID: 8e68190c9d7bb7aff1e8b59f683b8364c9255833acb3ed0292ca668db22258db
                                                            • Opcode Fuzzy Hash: c7e7795c5340e552953f02e34a8312dadeb5ff5321eb8b45fc04f055557940f6
                                                            • Instruction Fuzzy Hash: DC61F87A100500FFCF129F84CD41C65BBB2FF08718711849AFA999A632D736E821EF4A
                                                            Function 00491217 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 150registrystringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 0049123F
                                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,004670E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00491276
                                                            • lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 0049136E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$lstrlen
                                                            • String ID: BundleUpgradeCode$regutil.cpp
                                                            • API String ID: 3790715954-1648651458
                                                            • Opcode ID: 15a3186e561b844cc0aa680846ad564cb33af23ae696a139ca908fdbcf6ee0fe
                                                            • Instruction ID: 2d8c2cbd4c7ffa601d9376943c4a0ba434c5dd5ad812b02ab27748854753ae91
                                                            • Opcode Fuzzy Hash: 15a3186e561b844cc0aa680846ad564cb33af23ae696a139ca908fdbcf6ee0fe
                                                            • Instruction Fuzzy Hash: 89419435A0011BEFEF319F95C844AAF7BB9EB45710F1541BBED01EB620D6389D019BA8
                                                            Function 00496357 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0049490D: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00468770,00000000,00000000,00000000,00000000,00000000), ref: 00494925
                                                              • Part of subcall function 0049490D: GetLastError.KERNEL32(?,?,?,00468770,00000000,00000000,00000000,00000000,00000000), ref: 0049492F
                                                            • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00495C09,?,?,?,?,?,?,?,00010000,?), ref: 004963C0
                                                            • WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00495C09,?,?,?,?), ref: 00496412
                                                            • GetLastError.KERNEL32(?,00495C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00496458
                                                            • GetLastError.KERNEL32(?,00495C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 0049647E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$Write$Pointer
                                                            • String ID: dlutil.cpp
                                                            • API String ID: 133221148-2067379296
                                                            • Opcode ID: eeaa6cb95f51df82aead64d3931477751efbda8500f4c9ac03da8b6b755b6438
                                                            • Instruction ID: 7afb5e0519af848622126dcc66d862e0de43ab39f8bc05e38b21711d380e447c
                                                            • Opcode Fuzzy Hash: eeaa6cb95f51df82aead64d3931477751efbda8500f4c9ac03da8b6b755b6438
                                                            • Instruction Fuzzy Hash: CC418E72940219BFEF218E94CD45BAB7FA8EF04764F164236FD00A6190D339DD20DBA8
                                                            Function 00452428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • WideCharToMultiByte.KERNEL32(?,00000000,0048FFEF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0048FFEF,004712CF,?,00000000), ref: 0045246E
                                                            • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0048FFEF,004712CF,?,00000000,0000FDE9,?,004712CF), ref: 0045247A
                                                              • Part of subcall function 00453BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BDB
                                                              • Part of subcall function 00453BD3: HeapSize.KERNEL32(00000000,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BE2
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                            • String ID: strutil.cpp
                                                            • API String ID: 3662877508-3612885251
                                                            • Opcode ID: eb0b989eadba5d0ec5b4c96b7d43766027e123a583ea8095c560f47f088cb398
                                                            • Instruction ID: ee0f8b4d5311eed71048f355855aad98b674ad1bba1b2c78f941252c3d1ea086
                                                            • Opcode Fuzzy Hash: eb0b989eadba5d0ec5b4c96b7d43766027e123a583ea8095c560f47f088cb398
                                                            • Instruction Fuzzy Hash: 4431FE3030021ABFE7109E658EC497737D9EB57366710423BFD119B292E7B9DC098799
                                                            Function 0048922B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • MultiByteToWideChar.KERNEL32(?,00000000,ECE85006,00482444,00000000,00000000,00483479,?,y4H,?,00000001,00482444,ECE85006,00000001,00483479,00483479), ref: 00489278
                                                            • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00489301
                                                            • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00489313
                                                            • __freea.LIBCMT ref: 0048931C
                                                              • Part of subcall function 0048521A: HeapAlloc.KERNEL32(00000000,?,?,?,00481F87,?,0000015D,?,?,?,?,004833E0,000000FF,00000000,?,?), ref: 0048524C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ByteCharMultiWide$AllocHeapStringType__freea
                                                            • String ID: y4H
                                                            • API String ID: 573072132-1733079192
                                                            • Opcode ID: 3d8db422ebf9ab0100f88df9e7b114efb4c579e47e441bf937e482ff84d4136b
                                                            • Instruction ID: 46d40b26674ecf032cfe3afa8ed79bc772e15a28006de5a19a5eff461b04bf97
                                                            • Opcode Fuzzy Hash: 3d8db422ebf9ab0100f88df9e7b114efb4c579e47e441bf937e482ff84d4136b
                                                            • Instruction Fuzzy Hash: B831E132A0061AABDF24AF65DC81DBF7BA5EB44314F08096AFC14D7291E739CC51CB94
                                                            Function 0047AD44 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 0047ADB3
                                                            Strings
                                                            • Failed to extract all payloads from container: %ls, xrefs: 0047ADF7
                                                            • Failed to extract payload: %ls from container: %ls, xrefs: 0047AE3E
                                                            • Failed to open container: %ls., xrefs: 0047AD85
                                                            • Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 0047AE4A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
                                                            • API String ID: 1825529933-3891707333
                                                            • Opcode ID: 69bf7a07ec47e0aa0141837ae91740385a85986ac85d4087e7ed9f414f45c8b4
                                                            • Instruction ID: 3140a888dadeadeb8037d439f9bb362a2b95f32d9c702ff76d660f44c83e0137
                                                            • Opcode Fuzzy Hash: 69bf7a07ec47e0aa0141837ae91740385a85986ac85d4087e7ed9f414f45c8b4
                                                            • Instruction Fuzzy Hash: 02313532C00215AFCF21AAE0CC45ECF7769AF44715F208127FD24A7191E7399A25DBEA
                                                            Function 0045F005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,00460654,00000001,00000001,00000001,00460654,00000000), ref: 0045F07D
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,00460654,00000001,00000001,00000001,00460654,00000000,00000001,00000000,?,00460654,00000001), ref: 0045F09A
                                                            Strings
                                                            • Failed to format key for update registration., xrefs: 0045F033
                                                            • Failed to remove update registration key: %ls, xrefs: 0045F0C7
                                                            • PackageVersion, xrefs: 0045F05E
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCompareString
                                                            • String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
                                                            • API String ID: 446873843-3222553582
                                                            • Opcode ID: a2d16cd7edc69b427c9fd7386c28eef89901228b8b93ebba2e70a5b98b5ee60e
                                                            • Instruction ID: f2e209dc10027b31bf8c622434ab2d6a06ac7323a54495b46465cf3cc6eb093b
                                                            • Opcode Fuzzy Hash: a2d16cd7edc69b427c9fd7386c28eef89901228b8b93ebba2e70a5b98b5ee60e
                                                            • Instruction Fuzzy Hash: 1F21B631900129BBCF219BA5CD09FAFBEB8DF01B25F140177FD14E2192E7798A44D699
                                                            Function 0049433D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00494440: FindFirstFileW.KERNEL32(0047923A,?,00000100,00000000,00000000), ref: 0049447B
                                                              • Part of subcall function 00494440: FindClose.KERNEL32(00000000), ref: 00494487
                                                            • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00494430
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                              • Part of subcall function 00491217: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 0049123F
                                                              • Part of subcall function 00491217: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,004670E8,00000100,000000B0,00000088,00000410,000002C0), ref: 00491276
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseFindQueryValue$FileFirstOpen
                                                            • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
                                                            • API String ID: 3397690329-3978359083
                                                            • Opcode ID: b5f09de94fe22126a7c38656d4bc5fa88cce287dc3c3c6b9a204eaf1a5f5c175
                                                            • Instruction ID: d5f23d04be989e9b3549ebf5373cabefef9ec9b9f3fa85f85e60dd16f2274c64
                                                            • Opcode Fuzzy Hash: b5f09de94fe22126a7c38656d4bc5fa88cce287dc3c3c6b9a204eaf1a5f5c175
                                                            • Instruction Fuzzy Hash: 8B31B131A00219AADF21AF91CC41EAEBF74EB94754F5480BBE904A6251D3399E52CB68
                                                            Function 00494019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CopyFileW.KERNEL32(00000000,00454DBC,00000000,?,?,00000000,?,0049412D,00000000,00454DBC,00000000,00000000,?,004685EE,?,?), ref: 00494033
                                                            • GetLastError.KERNEL32(?,0049412D,00000000,00454DBC,00000000,00000000,?,004685EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00494041
                                                            • CopyFileW.KERNEL32(00000000,00454DBC,00000000,00454DBC,00000000,?,0049412D,00000000,00454DBC,00000000,00000000,?,004685EE,?,?,00000001), ref: 004940AC
                                                            • GetLastError.KERNEL32(?,0049412D,00000000,00454DBC,00000000,00000000,?,004685EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 004940B6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CopyErrorFileLast
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 374144340-2967768451
                                                            • Opcode ID: e6f2dbb5391db0dc10b148da4088fcf5c54110c9199620caca5a836667f34e23
                                                            • Instruction ID: 9160329df3633056b3f0f8cb5d4b0d31ffb04ca0dd2fa7a072d8dc1aaa80d89c
                                                            • Opcode Fuzzy Hash: e6f2dbb5391db0dc10b148da4088fcf5c54110c9199620caca5a836667f34e23
                                                            • Instruction Fuzzy Hash: F821D33668133297DF300A96DC44F3B6E98EF91BA0B154177FF04DB211E7588C4282E9
                                                            Function 0045EF1B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 0045EF56
                                                              • Part of subcall function 00494153: SetFileAttributesW.KERNEL32(0047923A,00000080,00000000,0047923A,000000FF,00000000,?,?,0047923A), ref: 00494182
                                                              • Part of subcall function 00494153: GetLastError.KERNEL32(?,?,0047923A), ref: 0049418C
                                                              • Part of subcall function 00453C6B: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,0045EFA1,00000001,00000000,00000095,00000001,00460663,00000095,00000000,swidtag,00000001), ref: 00453C88
                                                            Strings
                                                            • swidtag, xrefs: 0045EF65
                                                            • Failed to allocate regid file path., xrefs: 0045EFB5
                                                            • Failed to format tag folder path., xrefs: 0045EFC3
                                                            • Failed to allocate regid folder path., xrefs: 0045EFBC
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AttributesDirectoryErrorFileLastOpen@16Remove
                                                            • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
                                                            • API String ID: 1428973842-4170906717
                                                            • Opcode ID: fc1670abc1654c325808caab6a1c4b594f8a460d0fe49fce2dd5cedc525a06eb
                                                            • Instruction ID: 6aeb03bb1f18791835dd30681e30403d2e2a029e43b897c192678a1af34b7932
                                                            • Opcode Fuzzy Hash: fc1670abc1654c325808caab6a1c4b594f8a460d0fe49fce2dd5cedc525a06eb
                                                            • Instruction Fuzzy Hash: DE21C232D04518BBCF19DF9ACC01A9DFFB5AF44301F2080A7F818A6262DB799F459B58
                                                            Function 00478DB6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00478E3A
                                                            • RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,0045F7E0,00000001,00000100,000001B4,00000000), ref: 00478E88
                                                            Strings
                                                            • Failed to enumerate uninstall key for related bundles., xrefs: 00478E99
                                                            • SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478DD7
                                                            • Failed to open uninstall registry key., xrefs: 00478DFD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCompareOpenString
                                                            • String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                                                            • API String ID: 2817536665-2531018330
                                                            • Opcode ID: 20089d6d44542d5a35219f1129da46beb210c6ce3c0de73ffd0e378d49ea2c54
                                                            • Instruction ID: 05ca6e3b99aaba55a194b49b923fc47e229aa1234cce6c055c1c40c4701577e2
                                                            • Opcode Fuzzy Hash: 20089d6d44542d5a35219f1129da46beb210c6ce3c0de73ffd0e378d49ea2c54
                                                            • Instruction Fuzzy Hash: 8721C932940218FFDF11AA94CC4AFEFBA79EB14724F24856EF414B6150DB7D0E90D698
                                                            Function 004932F3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VariantInit.OLEAUT32(?), ref: 00493309
                                                            • SysAllocString.OLEAUT32(?), ref: 00493325
                                                            • VariantClear.OLEAUT32(?), ref: 004933AC
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004933B7
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: StringVariant$AllocClearFreeInit
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 760788290-1270936966
                                                            • Opcode ID: 3ec8e552d867fc46a597c142d95bf1bacaa9d738a963f3ddcfa40ece943a05da
                                                            • Instruction ID: 4418dee099315e8ce0dc397f573c4cae6038f0c1a9807628112ad0c23b491e22
                                                            • Opcode Fuzzy Hash: 3ec8e552d867fc46a597c142d95bf1bacaa9d738a963f3ddcfa40ece943a05da
                                                            • Instruction Fuzzy Hash: 49217E31940219AFCB21DFA4C948EAFBFB9AF46716F15017AFD05AB210CB359E018B94
                                                            Function 0047D259 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0047D2EE
                                                            • ReleaseMutex.KERNEL32(?), ref: 0047D31C
                                                            • SetEvent.KERNEL32(?), ref: 0047D325
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
                                                            • String ID: Failed to allocate buffer.$NetFxChainer.cpp
                                                            • API String ID: 944053411-3611226795
                                                            • Opcode ID: 7903c94aa089f3bb204e37ffe536cce9638d3d8e31f6138fb7ea5db6cadb40ff
                                                            • Instruction ID: 0164375e0f042cfaf42bc7ae5f037faf767414d27c8e2273951c3dd19b500449
                                                            • Opcode Fuzzy Hash: 7903c94aa089f3bb204e37ffe536cce9638d3d8e31f6138fb7ea5db6cadb40ff
                                                            • Instruction Fuzzy Hash: 1C21F3B0A00306BFDB109F68D844A9AB7F5FF48324F10867AF964A7352C375AD518B94
                                                            Function 00495907 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00476B11,00000000,?), ref: 0049591D
                                                            • GetLastError.KERNEL32(?,?,00476B11,00000000,?,?,?,?,?,?,?,?,?,00476F28,?,?), ref: 0049592B
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00476B11,00000000,?), ref: 00495965
                                                            • GetLastError.KERNEL32(?,?,00476B11,00000000,?,?,?,?,?,?,?,?,?,00476F28,?,?), ref: 0049596F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ConfigErrorHeapLastQueryService$AllocateProcess
                                                            • String ID: svcutil.cpp
                                                            • API String ID: 355237494-1746323212
                                                            • Opcode ID: 3d31eeb92e9ccc6d5c66dbd3be999f9194c4120c03a8d8453d6a525646e72a5d
                                                            • Instruction ID: 6d905b1d62bbd66ba32aaa906ff0dd2d51510fb7635fd4610cf03aa65b1a64e0
                                                            • Opcode Fuzzy Hash: 3d31eeb92e9ccc6d5c66dbd3be999f9194c4120c03a8d8453d6a525646e72a5d
                                                            • Instruction Fuzzy Hash: C921D4B6941635EBFF225A929D04B9F6E69DB41BB1F314037FD04AB201E6288D0097E9
                                                            Function 00459839 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _memcpy_s
                                                            • String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
                                                            • API String ID: 2001391462-1605196437
                                                            • Opcode ID: c61d9c4526438dcd0bd9c2e69cbaafb044e646524e00027bd4a136dba1fb0da4
                                                            • Instruction ID: e66075a26eb93d6b4d075f41071a239346218a74efb74f62c6c7521b6faef9a9
                                                            • Opcode Fuzzy Hash: c61d9c4526438dcd0bd9c2e69cbaafb044e646524e00027bd4a136dba1fb0da4
                                                            • Instruction Fuzzy Hash: DE110833590210BADF153D6D9C86E9B3E54EF06752F140167FD006A293C66EDD1886E9
                                                            Function 00459E16 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _MREFOpen@16.MSPDB140-MSVCRT ref: 00459E38
                                                            Strings
                                                            • Failed to format path string., xrefs: 00459E43
                                                            • Failed get file version., xrefs: 00459E78
                                                            • Failed to set variable., xrefs: 00459E97
                                                            • File search: %ls, did not find path: %ls, xrefs: 00459EA3
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open@16
                                                            • String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
                                                            • API String ID: 3613110473-2458530209
                                                            • Opcode ID: 9f66ce882e83ea66eaa563dd29fba32f7e26578fcf531b03658485983d65ec65
                                                            • Instruction ID: 9740bf78e672589863fa9097dc1e2e8ec1144ff37ef5252d67d682af0b52affc
                                                            • Opcode Fuzzy Hash: 9f66ce882e83ea66eaa563dd29fba32f7e26578fcf531b03658485983d65ec65
                                                            • Instruction Fuzzy Hash: 9111B132D40118FBCF02AAD5CC429AEBF68EF14755F1041ABFD0066252D7395E149799
                                                            Function 0046820F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00468E17,0000001A,00000000,?,00000000,00000000), ref: 00468258
                                                            • GetLastError.KERNEL32(?,?,00468E17,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 00468262
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateCreateErrorKnownLastProcessWell
                                                            • String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
                                                            • API String ID: 2186923214-2110050797
                                                            • Opcode ID: a854ef1c26d8fb917e8d84522ddc4904e7e0e0d7a12d71bed534a3004acb829b
                                                            • Instruction ID: 0a6cc6eefd34ac3a9aae6da781235dbea967b48d435afb9a97c338a871f4c17d
                                                            • Opcode Fuzzy Hash: a854ef1c26d8fb917e8d84522ddc4904e7e0e0d7a12d71bed534a3004acb829b
                                                            • Instruction Fuzzy Hash: 26012933542625B7C63166969D06E5F6B5CCF91B71B2101AFFD00AB241FE7C8D0041ED
                                                            Function 0047DDA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 0047DDCE
                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0047DDF8
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0047DFC8,00000000,?,?,?,?,00000000), ref: 0047DE00
                                                            Strings
                                                            • Failed while waiting for download., xrefs: 0047DE2E
                                                            • bitsengine.cpp, xrefs: 0047DE24
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessageMultipleObjectsPeekWait
                                                            • String ID: Failed while waiting for download.$bitsengine.cpp
                                                            • API String ID: 435350009-228655868
                                                            • Opcode ID: 43f9a89d361dc21015f3bd87eda009b9e7cac7d3569448bc13c900e4b6909a87
                                                            • Instruction ID: ad695c7a2bdc8d5040af6b769f60313948d9b32d7441aef06ef20e3713b1c4f2
                                                            • Opcode Fuzzy Hash: 43f9a89d361dc21015f3bd87eda009b9e7cac7d3569448bc13c900e4b6909a87
                                                            • Instruction Fuzzy Hash: 1E11E373A4122567D6219AA99D09EDBBA6CDF18B61F104127FE08BA280D6699D0081E9
                                                            Function 00493C72 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ShellExecuteExW.SHELL32(?), ref: 00493CC0
                                                            • GetLastError.KERNEL32(?,?,00000000), ref: 00493CCA
                                                            • CloseHandle.KERNEL32(?,?,?,00000000), ref: 00493CFD
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseErrorExecuteHandleLastShell
                                                            • String ID: <$shelutil.cpp
                                                            • API String ID: 3023784893-3991740012
                                                            • Opcode ID: b940c484f6357625c44066d1f78ca66b5965adbf705d67d99f4b545745d34654
                                                            • Instruction ID: e3755bb387d55b566e574ba4cbdaaabae17668553ae66c1897fbfb70f5347bbc
                                                            • Opcode Fuzzy Hash: b940c484f6357625c44066d1f78ca66b5965adbf705d67d99f4b545745d34654
                                                            • Instruction Fuzzy Hash: 1311D876E01219ABCB10DFA9E945A8E7BF8AF09751F10412AFD15F7340E7349E10CBA9
                                                            Function 00455F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetComputerNameW.KERNEL32(?,00000010), ref: 00455F5C
                                                            • GetLastError.KERNEL32 ref: 00455F66
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ComputerErrorLastName
                                                            • String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 3560734967-484636765
                                                            • Opcode ID: 06e1e1b3cd1ef8904af48fb860faaa36d7b920a9fbb20b2fdb8871499434adc0
                                                            • Instruction ID: 120169f060e6ed1e1b650637c7895f79eb85edaf976d9cc0a813220678f8f448
                                                            • Opcode Fuzzy Hash: 06e1e1b3cd1ef8904af48fb860faaa36d7b920a9fbb20b2fdb8871499434adc0
                                                            • Instruction Fuzzy Hash: E111EC33A415286BCB10DB959C05BEE77E8DB08721F114177FD00F7281D678AD0446E9
                                                            Function 00455E94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(?), ref: 00455EA6
                                                              • Part of subcall function 00490ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00455EB2,00000000), ref: 00490AE0
                                                              • Part of subcall function 00490ACC: GetProcAddress.KERNEL32(00000000), ref: 00490AE7
                                                              • Part of subcall function 00490ACC: GetLastError.KERNEL32(?,?,?,00455EB2,00000000), ref: 00490AFE
                                                              • Part of subcall function 00493D1F: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00493D4C
                                                            Strings
                                                            • Failed to get shell folder., xrefs: 00455EDA
                                                            • variable.cpp, xrefs: 00455ED0
                                                            • Failed to get 64-bit folder., xrefs: 00455EF0
                                                            • Failed to set variant value., xrefs: 00455F0A
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
                                                            • String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
                                                            • API String ID: 2084161155-3906113122
                                                            • Opcode ID: 2105560d1843674f4e34b1f637e0904f44ee4daefe597c4cc1f2d26590dd5c41
                                                            • Instruction ID: d37be568170ac0194767d58ea6f901087f4f96cff5609b4f52eb44115e408b38
                                                            • Opcode Fuzzy Hash: 2105560d1843674f4e34b1f637e0904f44ee4daefe597c4cc1f2d26590dd5c41
                                                            • Instruction Fuzzy Hash: 3B01E532901628BBCF12AB90DC16BAE3E68EF00756F204167FC00B6142DB7C9E4497DD
                                                            Function 00494153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00494440: FindFirstFileW.KERNEL32(0047923A,?,00000100,00000000,00000000), ref: 0049447B
                                                              • Part of subcall function 00494440: FindClose.KERNEL32(00000000), ref: 00494487
                                                            • SetFileAttributesW.KERNEL32(0047923A,00000080,00000000,0047923A,000000FF,00000000,?,?,0047923A), ref: 00494182
                                                            • GetLastError.KERNEL32(?,?,0047923A), ref: 0049418C
                                                            • DeleteFileW.KERNEL32(0047923A,00000000,0047923A,000000FF,00000000,?,?,0047923A), ref: 004941AC
                                                            • GetLastError.KERNEL32(?,?,0047923A), ref: 004941B6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 3967264933-2967768451
                                                            • Opcode ID: bf4d8b1d33ad252af4d5599f1160f1265d00674b0a8516784c29f813a60bb143
                                                            • Instruction ID: 1532b5eb83bc3bb0c87bd7ea27f782f9feae2d5ded2b28bca084007beb9c45d6
                                                            • Opcode Fuzzy Hash: bf4d8b1d33ad252af4d5599f1160f1265d00674b0a8516784c29f813a60bb143
                                                            • Instruction Fuzzy Hash: 7B014E32A41635A7DF3146A6DD0AF5F7E98AF60791F010337FC04EA2C0E3248D8181D8
                                                            Function 0047DA05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 0047DA1A
                                                            • LeaveCriticalSection.KERNEL32(?), ref: 0047DA5F
                                                            • SetEvent.KERNEL32(?,?,?,?), ref: 0047DA73
                                                            Strings
                                                            • Failure while sending progress during BITS job modification., xrefs: 0047DA4E
                                                            • Failed to get state during job modification., xrefs: 0047DA33
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterEventLeave
                                                            • String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
                                                            • API String ID: 3094578987-1258544340
                                                            • Opcode ID: 9cb6edafb392bb9334762fc91ff9a129e54a10980baba9aec5e81542264b8935
                                                            • Instruction ID: e8501cf0ad37b8c1ab6f9d1eafba2996f767828bae3d8488b6aa2fc212d3f588
                                                            • Opcode Fuzzy Hash: 9cb6edafb392bb9334762fc91ff9a129e54a10980baba9aec5e81542264b8935
                                                            • Instruction Fuzzy Hash: BB01D672904614BBCB11DB55D849A9EB7BCFF14721B00815BE409D3200D734ED04C6D9
                                                            Function 0047DC7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,0047DDEE), ref: 0047DC92
                                                            • LeaveCriticalSection.KERNEL32(00000008,?,0047DDEE), ref: 0047DCD7
                                                            • SetEvent.KERNEL32(?,?,0047DDEE), ref: 0047DCEB
                                                            Strings
                                                            • Failed to get BITS job state., xrefs: 0047DCAB
                                                            • Failure while sending progress., xrefs: 0047DCC6
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterEventLeave
                                                            • String ID: Failed to get BITS job state.$Failure while sending progress.
                                                            • API String ID: 3094578987-2876445054
                                                            • Opcode ID: 12ba62dcb58451c53bc0fae5c6db1661b47474da721a9788c0d311cdf33a438e
                                                            • Instruction ID: ad209581ffb57712d3da22693f8da87ac2dd89c33302828dc2bd9303ce29cc15
                                                            • Opcode Fuzzy Hash: 12ba62dcb58451c53bc0fae5c6db1661b47474da721a9788c0d311cdf33a438e
                                                            • Instruction Fuzzy Hash: 3B014532A00714AFCB129B05D9499DBBBB8FF14320700816BF80993600DB78ED00C7EC
                                                            Function 0047D7E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,0047DF52,?,?,?,?,?,?,00000000,00000000), ref: 0047D802
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0047DF52,?,?,?,?,?,?,00000000,00000000), ref: 0047D80D
                                                            • GetLastError.KERNEL32(?,0047DF52,?,?,?,?,?,?,00000000,00000000), ref: 0047D81A
                                                            Strings
                                                            • bitsengine.cpp, xrefs: 0047D83E
                                                            • Failed to create BITS job complete event., xrefs: 0047D848
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateCriticalErrorEventInitializeLastSection
                                                            • String ID: Failed to create BITS job complete event.$bitsengine.cpp
                                                            • API String ID: 3069647169-3441864216
                                                            • Opcode ID: 3b653609578a809b400dc0923ad06bbb39e212195f6056f3e3971804ad7c60af
                                                            • Instruction ID: f13309248e1e84bdd4e0ca5e2ce0822c263414998ed5bf159129ba47ca896454
                                                            • Opcode Fuzzy Hash: 3b653609578a809b400dc0923ad06bbb39e212195f6056f3e3971804ad7c60af
                                                            • Instruction Fuzzy Hash: 060192729516226BC310AF56D805A8BBFA8FF09B61B01812BFD1CE7640E7749800CBE9
                                                            Function 0045D4A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00467040,000000B8,00000000,?,00000000,7707B390), ref: 0045D4B7
                                                            • InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0045D4C6
                                                            • LeaveCriticalSection.KERNEL32(000000D0,?,00467040,000000B8,00000000,?,00000000,7707B390), ref: 0045D4DB
                                                            Strings
                                                            • userexperience.cpp, xrefs: 0045D4F4
                                                            • Engine active cannot be changed because it was already in that state., xrefs: 0045D4FE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
                                                            • String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
                                                            • API String ID: 3376869089-1544469594
                                                            • Opcode ID: 2cba9831e98a65d7d5c08e112af45209d6bcc402c6cde41770472f962d5969eb
                                                            • Instruction ID: cd988f23ad317ae95c682617b61a3486401844b3c0624d53b76e089a38f718b2
                                                            • Opcode Fuzzy Hash: 2cba9831e98a65d7d5c08e112af45209d6bcc402c6cde41770472f962d5969eb
                                                            • Instruction Fuzzy Hash: EDF0A4323006087F97219FA6AC85D9B77ACFF95766310443BF901C3241D678E8098768
                                                            Function 00491C88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00491CB3
                                                            • GetLastError.KERNEL32(?,004549DA,00000001,?,?,00454551,?,?,?,?,00455466,?,?,?,?), ref: 00491CC2
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorLastProc
                                                            • String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
                                                            • API String ID: 199729137-398595594
                                                            • Opcode ID: a0a1561329fe8976366f2de03a120867d495fa68b54c817974c7ea04f001c0ec
                                                            • Instruction ID: 41caa808ab56629f6079130fbd8ed9ac3511f82b9b6d4a4e34266f55d385ba1e
                                                            • Opcode Fuzzy Hash: a0a1561329fe8976366f2de03a120867d495fa68b54c817974c7ea04f001c0ec
                                                            • Instruction Fuzzy Hash: 63018637AC163353DB2156A66C09B9A6E449B107A2F120237FD01AB371D66CDC40C6EE
                                                            Function 0048495D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0048490E,00000000,?,004848AE,00000000,004B7F08,0000000C,00484A05,00000000,00000002), ref: 0048497D
                                                            • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00484990
                                                            • FreeLibrary.KERNEL32(00000000,?,?,?,0048490E,00000000,?,004848AE,00000000,004B7F08,0000000C,00484A05,00000000,00000002), ref: 004849B3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                            • String ID: CorExitProcess$mscoree.dll
                                                            • API String ID: 4061214504-1276376045
                                                            • Opcode ID: cea75f6e69dee9682b4160a4639dc0b4d2e6f61712ec40221cb0d6b922246ca4
                                                            • Instruction ID: 03287c53ee39c18fb3a5ff2cd6a95a2a977885ed3ab8863b8ae89c694def0f5a
                                                            • Opcode Fuzzy Hash: cea75f6e69dee9682b4160a4639dc0b4d2e6f61712ec40221cb0d6b922246ca4
                                                            • Instruction Fuzzy Hash: 5EF04470500219BFCB21AF65EC29BDEBFB4EB44755F40417AF805A2260CB754940CB99
                                                            Function 004521AC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 004521F2
                                                            • GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 004521FE
                                                              • Part of subcall function 00453BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BDB
                                                              • Part of subcall function 00453BD3: HeapSize.KERNEL32(00000000,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BE2
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                            • String ID: strutil.cpp
                                                            • API String ID: 3662877508-3612885251
                                                            • Opcode ID: dd27a31cdeaddb67a6e7d46f3359954fe91a9603e42552fccc133abc1535f24e
                                                            • Instruction ID: d63455af17d3cba5aad81d8cebb811ea92c5dc9c8846e7396183d0bc69385b9e
                                                            • Opcode Fuzzy Hash: dd27a31cdeaddb67a6e7d46f3359954fe91a9603e42552fccc133abc1535f24e
                                                            • Instruction Fuzzy Hash: 7231403A601226ABC7108E95CE44A6B3755AF13776F1103ABFC159B392D7B8DC0487D9
                                                            Function 004994FD Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 004995D5
                                                            • RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00499610
                                                            • RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 0049962C
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00499639
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 00499646
                                                              • Part of subcall function 00490FD5: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,004995C2,00000001), ref: 00490FED
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close$InfoOpenQuery
                                                            • String ID:
                                                            • API String ID: 796878624-0
                                                            • Opcode ID: 438e76489ac373efe1a3e92df7738b60d0b21d9d8871aaff1e3fd4258666e3da
                                                            • Instruction ID: 3a28652e17debfeb54e40c4ab4c17d7a6730466a8fc7935c10dcc093fe3201ad
                                                            • Opcode Fuzzy Hash: 438e76489ac373efe1a3e92df7738b60d0b21d9d8871aaff1e3fd4258666e3da
                                                            • Instruction Fuzzy Hash: 1A411B72C0122DBFCF21AF988D819AEFEB9EF18754F11417AE910B6225C7354E509A98
                                                            Function 00458A07 Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00458BC8,0045972D,?,0045972D,?,?,0045972D,?,?), ref: 00458A27
                                                            • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00458BC8,0045972D,?,0045972D,?,?,0045972D,?,?), ref: 00458A2F
                                                            • CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00458BC8,0045972D,?,0045972D,?), ref: 00458A7E
                                                            • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00458BC8,0045972D,?,0045972D,?), ref: 00458AE0
                                                            • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00458BC8,0045972D,?,0045972D,?), ref: 00458B0D
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString$lstrlen
                                                            • String ID:
                                                            • API String ID: 1657112622-0
                                                            • Opcode ID: d20c66d4cd3243076ceb182c5b0bd7cf7e48491b2fa3dac1abfe1bb0faae810c
                                                            • Instruction ID: 02955eec96c3e6a47ec78a96fed84c4af5779113d492db6824f544cb71497afe
                                                            • Opcode Fuzzy Hash: d20c66d4cd3243076ceb182c5b0bd7cf7e48491b2fa3dac1abfe1bb0faae810c
                                                            • Instruction Fuzzy Hash: EA316072A00108AFCF118F59CC859AF3F6AEB48391F14402FFD09A7212CE399D95DB99
                                                            Function 004574B7 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(004553BD,WixBundleOriginalSource,?,?,0046A623,840F01E8,WixBundleOriginalSource,?,004BAA90,?,00000000,00455445,00000001,?,?,ETE), ref: 004574C3
                                                            • LeaveCriticalSection.KERNEL32(004553BD,004553BD,00000000,00000000,?,?,0046A623,840F01E8,WixBundleOriginalSource,?,004BAA90,?,00000000,00455445,00000001,?), ref: 0045752A
                                                            Strings
                                                            • Failed to get value as string for variable: %ls, xrefs: 00457519
                                                            • WixBundleOriginalSource, xrefs: 004574BF
                                                            • Failed to get value of variable: %ls, xrefs: 004574FD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
                                                            • API String ID: 3168844106-30613933
                                                            • Opcode ID: 2bd368fa7ce67e92b468a65a5a89a759fab089b4bbe05810840f86970798e1ac
                                                            • Instruction ID: d615c5af8eca6f9a2676c56fa12f74eb2b9aa17f35c834c3167a50a3decda6d1
                                                            • Opcode Fuzzy Hash: 2bd368fa7ce67e92b468a65a5a89a759fab089b4bbe05810840f86970798e1ac
                                                            • Instruction Fuzzy Hash: 22019E32944128FBCF225E50DD05A9E3F64EF10766F108176FD04A6622D33A9E1497D9
                                                            Function 0047D152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CloseHandle.KERNEL32(?,00000000,?,00000000,?,0047D148,00000000), ref: 0047D16D
                                                            • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0047D148,00000000), ref: 0047D179
                                                            • CloseHandle.KERNEL32(0049B518,00000000,?,00000000,?,0047D148,00000000), ref: 0047D186
                                                            • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0047D148,00000000), ref: 0047D193
                                                            • UnmapViewOfFile.KERNEL32(0049B4E8,00000000,?,0047D148,00000000), ref: 0047D1A2
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$FileUnmapView
                                                            • String ID:
                                                            • API String ID: 260491571-0
                                                            • Opcode ID: 2efa4b057e8d25028bbe64527483e233c9a855dca9406f32d39bdfb3a038f491
                                                            • Instruction ID: 8e08a51e5d779fb95c1b1d4aeb5bc202a563834a0063e83859fd75348db36514
                                                            • Opcode Fuzzy Hash: 2efa4b057e8d25028bbe64527483e233c9a855dca9406f32d39bdfb3a038f491
                                                            • Instruction Fuzzy Hash: 71011672800B159FCB31AF66D980847F7F9EE50711305C93FE1AA52A20C375A840CE44
                                                            Function 00497B16 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497C74
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497C7F
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497C8A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeString$Heap$AllocateProcess
                                                            • String ID: atomutil.cpp
                                                            • API String ID: 2724874077-4059165915
                                                            • Opcode ID: 68a657d9871f96f9688fbed7b0cfbda4afeef3f1e27f8db1c1f2f859290691d6
                                                            • Instruction ID: 101ff04d4c92f1bf79e38c6b0d5951aa5f6d6ebbf1eb5ccc709a1f77831d07e3
                                                            • Opcode Fuzzy Hash: 68a657d9871f96f9688fbed7b0cfbda4afeef3f1e27f8db1c1f2f859290691d6
                                                            • Instruction Fuzzy Hash: 3251957191422AAFCF21DF64CD44FAFBBB8AF00715F1101AAE904AB211D779ED00DBA4
                                                            Function 00498713 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00498820
                                                            • GetLastError.KERNEL32 ref: 0049882A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Time$ErrorFileLastSystem
                                                            • String ID: clbcatq.dll$timeutil.cpp
                                                            • API String ID: 2781989572-961924111
                                                            • Opcode ID: 603676af7a5c7c0313969fd055b59c5b8dd22518b3dd76c9d3f21038bea25c0d
                                                            • Instruction ID: 192d1f7e30b3518eb2944522626a5e5c640fb614764c4184420d1a8b5a6a44c5
                                                            • Opcode Fuzzy Hash: 603676af7a5c7c0313969fd055b59c5b8dd22518b3dd76c9d3f21038bea25c0d
                                                            • Instruction Fuzzy Hash: 6241E476A0021576DF20BFBD9C45ABF7B64AF52700F65493FA501A7280EA3DCE0183B9
                                                            Function 004936CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VariantInit.OLEAUT32(000002C0), ref: 004936E6
                                                            • SysAllocString.OLEAUT32(?), ref: 004936F6
                                                            • VariantClear.OLEAUT32(?), ref: 004937D5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Variant$AllocClearInitString
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 2213243845-1270936966
                                                            • Opcode ID: 985f4340e508594652a824522d2c9070e5abec8b35db86f62dc98dee6674130b
                                                            • Instruction ID: c2a96d3a2af97cf819dda82ddd75b41676c3319d89ed3384cab74239f94e9484
                                                            • Opcode Fuzzy Hash: 985f4340e508594652a824522d2c9070e5abec8b35db86f62dc98dee6674130b
                                                            • Instruction Fuzzy Hash: 984146B5900225ABCF11DFA5C888EAFBBA8AF06711F1541F6FC15EB211D638DE008B95
                                                            Function 00490E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00478E1B), ref: 00490EAA
                                                            • RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00478E1B,00000000), ref: 00490EC8
                                                            • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00478E1B,00000000,00000000,00000000), ref: 00490F1E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Enum$InfoQuery
                                                            • String ID: regutil.cpp
                                                            • API String ID: 73471667-955085611
                                                            • Opcode ID: 19105bcd317dc13abada7b2b60567577b533f11002edade5d09db9a87659d30e
                                                            • Instruction ID: 0b7f9a56120fccc3d6401f0e5e3df6bdad4d4a9f79dd22947c30bdb58cca6631
                                                            • Opcode Fuzzy Hash: 19105bcd317dc13abada7b2b60567577b533f11002edade5d09db9a87659d30e
                                                            • Instruction Fuzzy Hash: 22319276901129FFDF318A998D84EAFBB6CEF04750F150177FD04AB210D7B99E0096A8
                                                            Function 00497A10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497AF4
                                                            • SysFreeString.OLEAUT32(?), ref: 00497AFF
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00497B0A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeString$Heap$AllocateProcess
                                                            • String ID: atomutil.cpp
                                                            • API String ID: 2724874077-4059165915
                                                            • Opcode ID: 8ef8c6b3c4fcbb9d8289d88d2b7d2b8d636568cd91caf51d343d67eac1e17ed6
                                                            • Instruction ID: 3923026c73bc57e4bc1bad45abb414a78225f6dd29793ab47e45e23afebf1fa0
                                                            • Opcode Fuzzy Hash: 8ef8c6b3c4fcbb9d8289d88d2b7d2b8d636568cd91caf51d343d67eac1e17ed6
                                                            • Instruction Fuzzy Hash: 4C318432D14529BBCF129B95CC45E9EBFB8EF00B55F124176F900AB211D7B8AE049BD4
                                                            Function 00478B17 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00478E57,00000000,00000000), ref: 00478BD4
                                                            Strings
                                                            • Failed to initialize package from related bundle id: %ls, xrefs: 00478BBA
                                                            • Failed to open uninstall key for potential related bundle: %ls, xrefs: 00478B43
                                                            • Failed to ensure there is space for related bundles., xrefs: 00478B87
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseOpen
                                                            • String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
                                                            • API String ID: 47109696-1717420724
                                                            • Opcode ID: 756fa37afc3344fd4fc58c1502101bbfc553620e25caadc0073dc43414833dc7
                                                            • Instruction ID: 80471a71ff241e04a1361a12e054aa1615ee463dfa8112d293725d90987e4627
                                                            • Opcode Fuzzy Hash: 756fa37afc3344fd4fc58c1502101bbfc553620e25caadc0073dc43414833dc7
                                                            • Instruction Fuzzy Hash: 5B21C4B2880119FBDF128E40CC0AFEE7B68EF14715F10805BF91466150DB79AA24E799
                                                            Function 00453B15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,00451474,00000000,80004005,00000000,80004005,00000000,000001C7,?,004513B8), ref: 00453B33
                                                            • HeapReAlloc.KERNEL32(00000000,?,00451474,00000000,80004005,00000000,80004005,00000000,000001C7,?,004513B8,000001C7,00000100,?,80004005,00000000), ref: 00453B3A
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                              • Part of subcall function 00453BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BDB
                                                              • Part of subcall function 00453BD3: HeapSize.KERNEL32(00000000,?,004521CC,000001C7,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453BE2
                                                            • _memcpy_s.LIBCMT ref: 00453B86
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$Process$AllocAllocateSize_memcpy_s
                                                            • String ID: memutil.cpp
                                                            • API String ID: 3406509257-2429405624
                                                            • Opcode ID: 2c1209a789f3884fd46a88a8154e9e42cfd125b7f34ca27dfca4926c3e7d96a3
                                                            • Instruction ID: 344495e8e6cb00d98c5068236e4ae78c72204eeb08d7ed193a57561a3c256f13
                                                            • Opcode Fuzzy Hash: 2c1209a789f3884fd46a88a8154e9e42cfd125b7f34ca27dfca4926c3e7d96a3
                                                            • Instruction Fuzzy Hash: 2C11E431504118ABCB226E68DC48E6F3A59DB407E7B05422BFC149B363D739EF1892E8
                                                            Function 0049894D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32 ref: 00498991
                                                            • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004989B9
                                                            • GetLastError.KERNEL32 ref: 004989C3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastTime$FileSystem
                                                            • String ID: inetutil.cpp
                                                            • API String ID: 1528435940-2900720265
                                                            • Opcode ID: aa408e48cd2de008294e7fa80cb4753e41ed450b1deb11f85ed4509e23bb558e
                                                            • Instruction ID: 0a129ef5e3f84d20881cb992a3042fc8ae3d13c1657e6a670315738f248e43b8
                                                            • Opcode Fuzzy Hash: aa408e48cd2de008294e7fa80cb4753e41ed450b1deb11f85ed4509e23bb558e
                                                            • Instruction Fuzzy Hash: 7C11DA73901139A7D7209BA99D05BBFBFA8DB45750F01053BAE44F7200D628DD0486E6
                                                            Function 00463AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00463FB5,feclient.dll,?,00000000,?,?,?,00454B12), ref: 00463B42
                                                              • Part of subcall function 004910B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0049112B
                                                              • Part of subcall function 004910B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00491163
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$CloseOpen
                                                            • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                            • API String ID: 1586453840-3596319545
                                                            • Opcode ID: 2b0cf24f2251d2cd370a59470c09c82f0cb1b30cf11d2504dcad45e08f070040
                                                            • Instruction ID: 2cd9ced6478d1c5656d9e9cced34ffcc29db3fb1d16e1b38790acc9e48a4e1ee
                                                            • Opcode Fuzzy Hash: 2b0cf24f2251d2cd370a59470c09c82f0cb1b30cf11d2504dcad45e08f070040
                                                            • Instruction Fuzzy Hash: 9111B432A40248BBDB21DE95DC42EBBBBB8EB10B02F500077E50057156E6796F81D755
                                                            Function 00490764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenA.KERNEL32(004712CF,00000000,00000000,?,?,?,00490013,004712CF,004712CF,?,00000000,0000FDE9,?,004712CF,8007139F,Invalid operation for this state.), ref: 00490776
                                                            • WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,00490013,004712CF,004712CF,?,00000000,0000FDE9,?,004712CF,8007139F), ref: 004907B2
                                                            • GetLastError.KERNEL32(?,?,00490013,004712CF,004712CF,?,00000000,0000FDE9,?,004712CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 004907BC
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastWritelstrlen
                                                            • String ID: logutil.cpp
                                                            • API String ID: 606256338-3545173039
                                                            • Opcode ID: 162d0cd89f1bf94b905c6c97905ace0cdee3068d151a95f9a313944f9680c4a9
                                                            • Instruction ID: ca9c5ef43e0145b9a5f1039a984e23472ab9fffe45d3cb6c7a7427276b2e0ac3
                                                            • Opcode Fuzzy Hash: 162d0cd89f1bf94b905c6c97905ace0cdee3068d151a95f9a313944f9680c4a9
                                                            • Instruction Fuzzy Hash: 2F11CA72940124BFC7109AA69D44AAFBE6CEB447B1B110277FD00D7240DB78AD40C9E8
                                                            Function 0045120A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0045523F,00000000,?), ref: 00451248
                                                            • GetLastError.KERNEL32(?,?,?,0045523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00451252
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ArgvCommandErrorLastLine
                                                            • String ID: apputil.cpp$ignored
                                                            • API String ID: 3459693003-568828354
                                                            • Opcode ID: 886e2a2a15a5ea8752ba3770ab49c00f6a7bf5384c1420e619a729751e664f78
                                                            • Instruction ID: 63bc15ee3390558458bfe147087848a7307b5eb932b70f386b8cbd38788d6ab5
                                                            • Opcode Fuzzy Hash: 886e2a2a15a5ea8752ba3770ab49c00f6a7bf5384c1420e619a729751e664f78
                                                            • Instruction Fuzzy Hash: AB119076900128AB8B21DB99D905E9FBBA8EF44751F1101ABFC04F7221D7349E0496E8
                                                            Function 0047D1B3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,0047D3EE,00000000,00000000,00000000,?), ref: 0047D1C3
                                                            • ReleaseMutex.KERNEL32(?,?,0047D3EE,00000000,00000000,00000000,?), ref: 0047D24A
                                                              • Part of subcall function 0045394F: GetProcessHeap.KERNEL32(?,000001C7,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453960
                                                              • Part of subcall function 0045394F: RtlAllocateHeap.NTDLL(00000000,?,00452274,000001C7,00000001,80004005,8007139F,?,?,00490267,8007139F,?,00000000,00000000,8007139F), ref: 00453967
                                                            Strings
                                                            • NetFxChainer.cpp, xrefs: 0047D208
                                                            • Failed to allocate memory for message data, xrefs: 0047D212
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
                                                            • String ID: Failed to allocate memory for message data$NetFxChainer.cpp
                                                            • API String ID: 2993511968-1624333943
                                                            • Opcode ID: 3972454cc98d0a7ac84508bb22c3aa7e8ab079fea34eb86e25af030de4a4c5af
                                                            • Instruction ID: 944d4cb5c7babd9db3e83b4621c3a955001abfe0466c45317779d285d1d3fe31
                                                            • Opcode Fuzzy Hash: 3972454cc98d0a7ac84508bb22c3aa7e8ab079fea34eb86e25af030de4a4c5af
                                                            • Instruction Fuzzy Hash: BE11C4B1300215AFCB059F54E845E9AB7F4FF09724B10417AF9189B352C735AC11CBE8
                                                            Function 00451F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • FormatMessageW.KERNEL32(0045428F,0045548E,?,00000000,00000000,00000000,?,80070656,?,?,?,0046E75C,00000000,0045548E,00000000,80070656), ref: 00451F9A
                                                            • GetLastError.KERNEL32(?,?,?,0046E75C,00000000,0045548E,00000000,80070656,?,?,004640BF,0045548E,?,80070656,00000001,crypt32.dll), ref: 00451FA7
                                                            • LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,0046E75C,00000000,0045548E,00000000,80070656,?,?,004640BF,0045548E), ref: 00451FEE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFormatFreeLastLocalMessage
                                                            • String ID: strutil.cpp
                                                            • API String ID: 1365068426-3612885251
                                                            • Opcode ID: 97ead0e2ce9a3b3c634a9ee9e0507018892eac54d2e5b0861518cd889800656f
                                                            • Instruction ID: 31638deb8292c45b9d411187a54afbcc847029ecc339af226f12a14907614375
                                                            • Opcode Fuzzy Hash: 97ead0e2ce9a3b3c634a9ee9e0507018892eac54d2e5b0861518cd889800656f
                                                            • Instruction Fuzzy Hash: 3801EDB7900129BBDB208F91DD09ADFBAACEB04711F004167BD00E7221E7388E048BE4
                                                            Function 00460721 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00460791
                                                            Strings
                                                            • Failed to update name and publisher., xrefs: 0046077B
                                                            • Failed to update resume mode., xrefs: 00460762
                                                            • Failed to open registration key., xrefs: 00460748
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseOpen
                                                            • String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
                                                            • API String ID: 47109696-1865096027
                                                            • Opcode ID: e1d3c4e3e8a958c5881141efc0bb91c24e1533efd89bbb590033863fda670084
                                                            • Instruction ID: ac356aedb1a4308dec4288c026daa6a20153a9d946467d0867ee3d81d0f3f266
                                                            • Opcode Fuzzy Hash: e1d3c4e3e8a958c5881141efc0bb91c24e1533efd89bbb590033863fda670084
                                                            • Instruction Fuzzy Hash: 1901DD32941628F7CB225694DC41FAF7A689B10B11F100167F900B6150D779BE10A7DE
                                                            Function 00494DB3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(0049B500,40000000,00000001,00000000,00000002,00000080,00000000,004604BF,00000000,?,0045F4F4,?,00000080,0049B500,00000000), ref: 00494DCB
                                                            • GetLastError.KERNEL32(?,0045F4F4,?,00000080,0049B500,00000000,?,004604BF,?,00000094,?,?,?,?,?,00000000), ref: 00494DD8
                                                            • CloseHandle.KERNEL32(00000000,00000000,?,0045F4F4,?,0045F4F4,?,00000080,0049B500,00000000,?,004604BF,?,00000094), ref: 00494E2C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorFileHandleLast
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 2528220319-2967768451
                                                            • Opcode ID: 76a40a293dfa2c7f704ef03916dc50e2ca0a841b2f6afe366cd28b350e250c63
                                                            • Instruction ID: 488f8ce2f21a37e1e52a2780f6cbd6a62c0173db3e979b5606e85efa11e02278
                                                            • Opcode Fuzzy Hash: 76a40a293dfa2c7f704ef03916dc50e2ca0a841b2f6afe366cd28b350e250c63
                                                            • Instruction Fuzzy Hash: DA01F53364112467CE225A69DC09F5F3E54AB80B70F014336FF246A2D0D3248C0252E8
                                                            Function 0049497A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00478C76,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 004949AE
                                                            • GetLastError.KERNEL32(?,00478C76,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 004949BB
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateErrorFileLast
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 1214770103-2967768451
                                                            • Opcode ID: 23583be29486b623cbcb6be11b2ac39ccc1175443131a1e2b01caaa906680369
                                                            • Instruction ID: a8ce113800cf165aaefc228646a19a7c48124c514a1f7966c4ec8025319ec635
                                                            • Opcode Fuzzy Hash: 23583be29486b623cbcb6be11b2ac39ccc1175443131a1e2b01caaa906680369
                                                            • Instruction Fuzzy Hash: 39012B73680134B7DB2125A5EC09F7F2D58AB40B61F114137FF516A1C0C76C4D0151EC
                                                            Function 00476BEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49serviceCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ControlService.ADVAPI32(00476AFD,00000001,?,00000001,00000000,?,?,?,?,?,?,00476AFD,00000000), ref: 00476C13
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,00476AFD,00000000), ref: 00476C1D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ControlErrorLastService
                                                            • String ID: Failed to stop wusa service.$msuengine.cpp
                                                            • API String ID: 4114567744-2259829683
                                                            • Opcode ID: cbd0fee5dc64018a74d121d0a8fc185d6e48456105078c8e0ba303af4c3fc335
                                                            • Instruction ID: 17a738e0024c3f04f74f886a1df25bed7a6419c358dced93e6ff1acb6bb44170
                                                            • Opcode Fuzzy Hash: cbd0fee5dc64018a74d121d0a8fc185d6e48456105078c8e0ba303af4c3fc335
                                                            • Instruction Fuzzy Hash: 50012033A412386BD720DBA69D05BDF77A5DB48B10F11413BFD04BB280DA389C0045ED
                                                            Function 0046ECC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 0046ECED
                                                            • GetLastError.KERNEL32 ref: 0046ECF7
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046ED1B
                                                            • Failed to post elevate message., xrefs: 0046ED25
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessagePostThread
                                                            • String ID: EngineForApplication.cpp$Failed to post elevate message.
                                                            • API String ID: 2609174426-4098423239
                                                            • Opcode ID: f1fd84f2b7b58656833bc8ce063014e207b75df54def348529d003318d2c8491
                                                            • Instruction ID: e4ef5dffa006303624075f82a1fa4c4849a4392222ab21acba951710b78ef276
                                                            • Opcode Fuzzy Hash: f1fd84f2b7b58656833bc8ce063014e207b75df54def348529d003318d2c8491
                                                            • Instruction Fuzzy Hash: 99F0FC376402315BC7205A9A9C09B4777C4AF15B75B21413BFE14AF281E72DDC0182DD
                                                            Function 0045D8DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 0045D903
                                                            • FreeLibrary.KERNEL32(?,?,004548D7,00000000,?,?,0045548E,?,?), ref: 0045D912
                                                            • GetLastError.KERNEL32(?,004548D7,00000000,?,?,0045548E,?,?), ref: 0045D91C
                                                            Strings
                                                            • BootstrapperApplicationDestroy, xrefs: 0045D8FB
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorFreeLastLibraryProc
                                                            • String ID: BootstrapperApplicationDestroy
                                                            • API String ID: 1144718084-3186005537
                                                            • Opcode ID: c72c369c19dd9eb804bfb56ceb39f4fbb406547065c82ce6af7efefd4937ac0a
                                                            • Instruction ID: 4a82d7420d67aca37139c87e0b3616d8dff375256a310864dd037e02bde01387
                                                            • Opcode Fuzzy Hash: c72c369c19dd9eb804bfb56ceb39f4fbb406547065c82ce6af7efefd4937ac0a
                                                            • Instruction Fuzzy Hash: D1F06872A01626ABC3245F66E804B17F7A4FF14763705823BEC15D6621D765EC108BD8
                                                            Function 00493D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,fTE,?,00000000,00455466,?,?,?), ref: 00493DA7
                                                            • CoCreateInstance.OLE32(00000000,00000000,00000001,004B716C,?), ref: 00493DBF
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateFromInstanceProg
                                                            • String ID: Microsoft.Update.AutoUpdate$fTE
                                                            • API String ID: 2151042543-869455546
                                                            • Opcode ID: d3eaf87f5a83f0cd866c674269736734d27802802a221862266942899a40245d
                                                            • Instruction ID: 0800cdb05895c6c913d48c282a7afea5283634d4aa29a5cfc52e25fa94dead34
                                                            • Opcode Fuzzy Hash: d3eaf87f5a83f0cd866c674269736734d27802802a221862266942899a40245d
                                                            • Instruction Fuzzy Hash: 91F03A71600208BBDB10EFA9DD05AEFB7B8DB49710F50017AEE01E7190D675AE1486BA
                                                            Function 0046F2D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0046F2EE
                                                            • GetLastError.KERNEL32 ref: 0046F2F8
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046F31C
                                                            • Failed to post plan message., xrefs: 0046F326
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessagePostThread
                                                            • String ID: EngineForApplication.cpp$Failed to post plan message.
                                                            • API String ID: 2609174426-2952114608
                                                            • Opcode ID: daf8541b5a417d032e61ce7cf0871c57ba6b20096f50ead1bf31bf3f3d49b855
                                                            • Instruction ID: cc9ca14c6e2223892f2d9ad76d1b1b2161efe874caddcad42a5cb7aab3f486b4
                                                            • Opcode Fuzzy Hash: daf8541b5a417d032e61ce7cf0871c57ba6b20096f50ead1bf31bf3f3d49b855
                                                            • Instruction Fuzzy Hash: 73F0A7336412316BD6306AA6BC0AA4B7F84EF15BA1B114037FD44AF281E6689C4081DE
                                                            Function 0046F3E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0046F3FC
                                                            • GetLastError.KERNEL32 ref: 0046F406
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046F42A
                                                            • Failed to post shutdown message., xrefs: 0046F434
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessagePostThread
                                                            • String ID: EngineForApplication.cpp$Failed to post shutdown message.
                                                            • API String ID: 2609174426-188808143
                                                            • Opcode ID: ddaf9eec7c43234dccf088cc5fd06d7b2a6b5c04baf7e9297d7e5e9b99660c78
                                                            • Instruction ID: ac80bcb534d3f84b8689dde624b4f08ee1ab6ce6f16867354d21510f91106b8a
                                                            • Opcode Fuzzy Hash: ddaf9eec7c43234dccf088cc5fd06d7b2a6b5c04baf7e9297d7e5e9b99660c78
                                                            • Instruction Fuzzy Hash: F4F0A7336412356BC6315A967C09F8B7B94EF14BA1B114037BE54BB292FA589C0086DD
                                                            Function 004707B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetEvent.KERNEL32(0049B478,00000000,?,00471717,?,00000000,?,0045C287,?,00455405,?,004675A5,?,?,00455405,?), ref: 004707BF
                                                            • GetLastError.KERNEL32(?,00471717,?,00000000,?,0045C287,?,00455405,?,004675A5,?,?,00455405,?,00455445,00000001), ref: 004707C9
                                                            Strings
                                                            • cabextract.cpp, xrefs: 004707ED
                                                            • Failed to set begin operation event., xrefs: 004707F7
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorEventLast
                                                            • String ID: Failed to set begin operation event.$cabextract.cpp
                                                            • API String ID: 3848097054-4159625223
                                                            • Opcode ID: e52f55a75c647dff898cf19b171e2221307396614e83430c77ae1be0a8b95555
                                                            • Instruction ID: 08086d5f74c07ab025b90f1bb9a1e28e32b7e90d3ad193d27cc47afaf9ecd9ea
                                                            • Opcode Fuzzy Hash: e52f55a75c647dff898cf19b171e2221307396614e83430c77ae1be0a8b95555
                                                            • Instruction Fuzzy Hash: B7F02733643230A7822062A65D05ACF77889E05BA1712807BFE08BB240E71CAC00C2EF
                                                            Function 0046EBCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 0046EBE0
                                                            • GetLastError.KERNEL32 ref: 0046EBEA
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046EC0E
                                                            • Failed to post apply message., xrefs: 0046EC18
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessagePostThread
                                                            • String ID: EngineForApplication.cpp$Failed to post apply message.
                                                            • API String ID: 2609174426-1304321051
                                                            • Opcode ID: 1e7662008f848b1a446c52a43427b434517389945eec8c5aa621247d7164d2d2
                                                            • Instruction ID: a038b62d5e7e9ca714fe235126af9d35b539593685d43bd47152164ee948181b
                                                            • Opcode Fuzzy Hash: 1e7662008f848b1a446c52a43427b434517389945eec8c5aa621247d7164d2d2
                                                            • Instruction Fuzzy Hash: 35F0AE376412356BD63156975D0DE4B7EC4EF15B71B014027FD14AE181E6599C0081DD
                                                            Function 0046EC5C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0046EC71
                                                            • GetLastError.KERNEL32 ref: 0046EC7B
                                                            Strings
                                                            • EngineForApplication.cpp, xrefs: 0046EC9F
                                                            • Failed to post detect message., xrefs: 0046ECA9
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastMessagePostThread
                                                            • String ID: EngineForApplication.cpp$Failed to post detect message.
                                                            • API String ID: 2609174426-598219917
                                                            • Opcode ID: 1aa44a533fa4b762350f6b79ef88b5b7b753648027c7d5eb690b6b931b3ca8eb
                                                            • Instruction ID: 657784ec9e919a61feff62f4091ccb57df67d70fef12f3ae235a1286b6a3e23f
                                                            • Opcode Fuzzy Hash: 1aa44a533fa4b762350f6b79ef88b5b7b753648027c7d5eb690b6b931b3ca8eb
                                                            • Instruction Fuzzy Hash: 81F082376412316BD6345B97AC09B4B7FD4EF14BA1B124027BE04AA281E6689C00C5DD
                                                            Function 00486B76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: __alldvrm$_strrchr
                                                            • String ID:
                                                            • API String ID: 1036877536-0
                                                            • Opcode ID: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                            • Instruction ID: 1ae8f69324d59755db89ac7440cec874d82dd14bc96b602f57df3c8117b408ed
                                                            • Opcode Fuzzy Hash: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
                                                            • Instruction Fuzzy Hash: DEA14575A002869FDB21AF28C8817BEBBE5EF11314F1649AFE5859B381C63C8D41C759
                                                            Function 00495EC5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen
                                                            • String ID: dlutil.cpp
                                                            • API String ID: 1659193697-2067379296
                                                            • Opcode ID: dac813a10cdf0346dd71ac7b525a027577ea7c74df92f5cf9048b9022ad1dc14
                                                            • Instruction ID: db3e761a931150c84fd09d947a6f37631e5a1e9cb26cfac72b8035aa4352cee2
                                                            • Opcode Fuzzy Hash: dac813a10cdf0346dd71ac7b525a027577ea7c74df92f5cf9048b9022ad1dc14
                                                            • Instruction Fuzzy Hash: F351C272901619ABDF12DFA58C849AFBFB9EF48720F16413AFD04A7240D739DD009BA4
                                                            Function 00454FA4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CloseHandle.KERNEL32(?,?,?,00000000,?,00455552,?,?,?,?,?,?), ref: 00454FFE
                                                            • DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,00455552,?,?,?,?,?,?), ref: 00455012
                                                            • TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00455552,?,?), ref: 00455101
                                                            • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00455552,?,?), ref: 00455108
                                                              • Part of subcall function 00451161: LocalFree.KERNEL32(?,?,00454FBB,?,00000000,?,00455552,?,?,?,?,?,?), ref: 0045116B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalDeleteFreeSection$CloseHandleLocal
                                                            • String ID:
                                                            • API String ID: 3671900028-0
                                                            • Opcode ID: 0499c24c6d6a71a3bc280138abb62bb422d42be93aaedcc8e13256f71eb8222b
                                                            • Instruction ID: dee2de85c8e75cce4835b3416b5d12fbe4fa22af51e0ca4063e5019816ce2d81
                                                            • Opcode Fuzzy Hash: 0499c24c6d6a71a3bc280138abb62bb422d42be93aaedcc8e13256f71eb8222b
                                                            • Instruction Fuzzy Hash: ED412D71500B045BCA31EBB1D849B9B77ECAF04745F44082FBA99D3152EB3CE5498768
                                                            Function 00496067 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(?,?,00495FD0,00000000,00000000,00000001), ref: 004960DF
                                                            • GetLastError.KERNEL32(?,?,00495FD0,00000000,00000000,00000001), ref: 00496130
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast
                                                            • String ID: 8jK$dlutil.cpp
                                                            • API String ID: 1452528299-2459937920
                                                            • Opcode ID: 2019920eeabbdd237b7f7358aabaf3dd0f8f21d751698469598eda4f3cb2c737
                                                            • Instruction ID: 6a6080172a4e4ac8ec7881baca39602b4e015aa6f60b6ae3a6de6538d4985178
                                                            • Opcode Fuzzy Hash: 2019920eeabbdd237b7f7358aabaf3dd0f8f21d751698469598eda4f3cb2c737
                                                            • Instruction Fuzzy Hash: 1931F536941625A7CF229E958D46F9B7EA8AF41BA1F13023BFD00A7251D73CCD0096A8
                                                            Function 00493245 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysAllocString.OLEAUT32(?), ref: 00493258
                                                            • VariantInit.OLEAUT32(?), ref: 00493264
                                                            • VariantClear.OLEAUT32(?), ref: 004932D8
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004932E3
                                                              • Part of subcall function 00493498: SysAllocString.OLEAUT32(?), ref: 004934AD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$AllocVariant$ClearFreeInit
                                                            • String ID:
                                                            • API String ID: 347726874-0
                                                            • Opcode ID: 5709bd308c4e16de8dac080b59e5e4c56ef391c7b703ceb5a0f6784ad1f498e2
                                                            • Instruction ID: 817273f46c4aa29ff8476c05ff7e0b3a7a66e18f915505f098cc9e1938306ae6
                                                            • Opcode Fuzzy Hash: 5709bd308c4e16de8dac080b59e5e4c56ef391c7b703ceb5a0f6784ad1f498e2
                                                            • Instruction Fuzzy Hash: 5B213D35901219AFCF24DFA4C858EAFBBB9EF4A716F1141BAE80197210D7359E05CB94
                                                            Function 00454C86 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 0045F96C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00454CA5,?,?,00000001), ref: 0045F9BC
                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00454D0C
                                                            Strings
                                                            • Unable to get resume command line from the registry, xrefs: 00454CAB
                                                            • Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00454CF6
                                                            • Failed to get current process path., xrefs: 00454CCA
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close$Handle
                                                            • String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
                                                            • API String ID: 187904097-642631345
                                                            • Opcode ID: 8b48f34e4664afe0d3feea3e205d619def726581fb3ed5a491b5eb06afcf2a9f
                                                            • Instruction ID: f9b4c20b9ca8ea25e5e3bda457d86b8aa24ba37a49937242b6b70aa9ec2e4418
                                                            • Opcode Fuzzy Hash: 8b48f34e4664afe0d3feea3e205d619def726581fb3ed5a491b5eb06afcf2a9f
                                                            • Instruction Fuzzy Hash: 74118771D01518FB8F129B95DD0189EFFB8EF8071AB1041ABFC00B6211E7394E59EB89
                                                            Function 004888B2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00488A56,00000000,00000000,?,00488859,00488A56,00000000,00000000,00000000,?,00488A56,00000006,FlsSetValue), ref: 004888E4
                                                            • GetLastError.KERNEL32(?,00488859,00488A56,00000000,00000000,00000000,?,00488A56,00000006,FlsSetValue,004B2404,004B240C,00000000,00000364,?,00486230), ref: 004888F0
                                                            • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00488859,00488A56,00000000,00000000,00000000,?,00488A56,00000006,FlsSetValue,004B2404,004B240C,00000000), ref: 004888FE
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: LibraryLoad$ErrorLast
                                                            • String ID:
                                                            • API String ID: 3177248105-0
                                                            • Opcode ID: 6c4471bc713e619b528a037708c2c1ea7056e22204741a0f51fb940061c87cf0
                                                            • Instruction ID: 296b2958be0eae560fa57a27d6e4c6d73234966a90563d458cd52d01a8896013
                                                            • Opcode Fuzzy Hash: 6c4471bc713e619b528a037708c2c1ea7056e22204741a0f51fb940061c87cf0
                                                            • Instruction Fuzzy Hash: 75014C76245227ABC7216B69AC0497F3798EF15BA17500A3AF915E3340DB28DC01C7E9
                                                            Function 0048615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(?,00000000,00481AEC,00000000,80004004,?,00481DF0,00000000,80004004,00000000,00000000), ref: 00486162
                                                            • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 004861CA
                                                            • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 004861D6
                                                            • _abort.LIBCMT ref: 004861DC
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$_abort
                                                            • String ID:
                                                            • API String ID: 88804580-0
                                                            • Opcode ID: b957c3691886b3bdca19e6c59163c381fb674c7134751969f6db0c496f738472
                                                            • Instruction ID: 90abbf88a58615aadeb10bda6a7d812fc5369f6064fac90e46cc3d263e3c4efe
                                                            • Opcode Fuzzy Hash: b957c3691886b3bdca19e6c59163c381fb674c7134751969f6db0c496f738472
                                                            • Instruction Fuzzy Hash: F5F0A435644A01A7C65237267C0EB1F2659CFC1B75F26092FF91896297FF6C8802536D
                                                            Function 00457435 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 00457441
                                                            • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 004574A8
                                                            Strings
                                                            • Failed to get value as numeric for variable: %ls, xrefs: 00457497
                                                            • Failed to get value of variable: %ls, xrefs: 0045747B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
                                                            • API String ID: 3168844106-4270472870
                                                            • Opcode ID: ef98c6a9a26a824891d4e6b4f40e4c02ef32171f2a633fa47026873969e11ecd
                                                            • Instruction ID: a5e569d49c7e0584b0b16c2f59580b78a60248aeb561536ea8ef0341ab36fa69
                                                            • Opcode Fuzzy Hash: ef98c6a9a26a824891d4e6b4f40e4c02ef32171f2a633fa47026873969e11ecd
                                                            • Instruction Fuzzy Hash: DF019A32905128FBCF125E54ED09A9E7F25AF11762F108177FC04AA222C33AAE149BD9
                                                            Function 004575AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?), ref: 004575B6
                                                            • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 0045761D
                                                            Strings
                                                            • Failed to get value of variable: %ls, xrefs: 004575F0
                                                            • Failed to get value as version for variable: %ls, xrefs: 0045760C
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
                                                            • API String ID: 3168844106-1851729331
                                                            • Opcode ID: 2306f4ddf06a201158cbd0102c5fe48b582822f968ad95a5bf64e8b0feead190
                                                            • Instruction ID: aeca84b279cd965d29fb90f986826023d6663a7098bba897cea0beca982dbb04
                                                            • Opcode Fuzzy Hash: 2306f4ddf06a201158cbd0102c5fe48b582822f968ad95a5bf64e8b0feead190
                                                            • Instruction Fuzzy Hash: 1001B136914528FBCF125F44DC09A9E3B24EF10766F104177FC04AA222D33A9E149BDD
                                                            Function 00457539 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00459897,00000000,?,00000000,00000000,00000000,?,004596D6,00000000,?,00000000,00000000), ref: 00457545
                                                            • LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00459897,00000000,?,00000000,00000000,00000000,?,004596D6,00000000,?,00000000), ref: 0045759B
                                                            Strings
                                                            • Failed to copy value of variable: %ls, xrefs: 0045758A
                                                            • Failed to get value of variable: %ls, xrefs: 0045756B
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$EnterLeave
                                                            • String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
                                                            • API String ID: 3168844106-2936390398
                                                            • Opcode ID: ede96ba7f6f97d5a68ace4114f6f67149bcad73054296262c63fe0e811937f32
                                                            • Instruction ID: cbb48baa5068b79460db9fcdd818568224573be50e1c63074f4ee3032ee1d4e0
                                                            • Opcode Fuzzy Hash: ede96ba7f6f97d5a68ace4114f6f67149bcad73054296262c63fe0e811937f32
                                                            • Instruction Fuzzy Hash: 5BF0813294412CBBCF125F54DC09E9E3F24EF14766F108176FC04A6222D33A9E1497D8
                                                            Function 0047E776 Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 0047E788
                                                            • GetCurrentThreadId.KERNEL32 ref: 0047E797
                                                            • GetCurrentProcessId.KERNEL32 ref: 0047E7A0
                                                            • QueryPerformanceCounter.KERNEL32(?), ref: 0047E7AD
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                            • String ID:
                                                            • API String ID: 2933794660-0
                                                            • Opcode ID: 9faad381a6fb8393cdb127a7705876d5bd524df80ad915e3ed5ddd4881f4e017
                                                            • Instruction ID: 6493315b3ac7ed50e1cab50364a5425d89f2ff4352a17fcf63bb899ff2f67ba5
                                                            • Opcode Fuzzy Hash: 9faad381a6fb8393cdb127a7705876d5bd524df80ad915e3ed5ddd4881f4e017
                                                            • Instruction Fuzzy Hash: 02F04271C1020DEBCB00DBB4EA49A9EB7F8EF18315F5148A6E815E7110E734AB049B95
                                                            Function 00490C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(00000000), ref: 00490DD7
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close
                                                            • String ID: regutil.cpp
                                                            • API String ID: 3535843008-955085611
                                                            • Opcode ID: 486abe60d678778a5ae646767de67327c832d9da60fcc85a184947b0e298267d
                                                            • Instruction ID: 1f942a2bc317ea6ce188faad8efd95b0d894afcec1d078336ce2db7e89b731f9
                                                            • Opcode Fuzzy Hash: 486abe60d678778a5ae646767de67327c832d9da60fcc85a184947b0e298267d
                                                            • Instruction Fuzzy Hash: 1641C032D01529EFDF358AD8C8047AE7E61AB40720F258377FD14AA250D77C9E41ABD8
                                                            Function 0049479B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 004948FC
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseOpen
                                                            • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                            • API String ID: 47109696-3023217399
                                                            • Opcode ID: a7515db59db724548abfa7ce6d8634c8a366dc35d71fd1b120cfe6b49b4c17b2
                                                            • Instruction ID: b2d9cc36b205f8f429004a33aa296c0b5dacfc71087ee554bdcfffa0f280a15a
                                                            • Opcode Fuzzy Hash: a7515db59db724548abfa7ce6d8634c8a366dc35d71fd1b120cfe6b49b4c17b2
                                                            • Instruction Fuzzy Hash: 1C416179E00159AFCF21EF98C945DAEBFB5EB84B10F2140BBE500A7211D7399E42DB58
                                                            Function 004910B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0049112B
                                                            • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00491163
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: QueryValue
                                                            • String ID: regutil.cpp
                                                            • API String ID: 3660427363-955085611
                                                            • Opcode ID: ac76f79c265c9753d7a1be85b99b7ab93d3749918d602ee72238a7a8ae162620
                                                            • Instruction ID: 0d482dd70ef7ccaef9314f1b3c38a60dbef15da2432ec753b54d2e9b5f63c986
                                                            • Opcode Fuzzy Hash: ac76f79c265c9753d7a1be85b99b7ab93d3749918d602ee72238a7a8ae162620
                                                            • Instruction Fuzzy Hash: 7B418332D0012BBBDF119E958C429AFBFB9EF08350F10417BEE10A7261D7799D118798
                                                            Function 004866D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • WideCharToMultiByte.KERNEL32(0049B518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 004867A3
                                                            • GetLastError.KERNEL32 ref: 004867BF
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ByteCharErrorLastMultiWide
                                                            • String ID: comres.dll
                                                            • API String ID: 203985260-246242247
                                                            • Opcode ID: b974c2f3ea8aad4c3aa75f734db5a636694e435bef09d89c52c2fc79a0bf9def
                                                            • Instruction ID: 81a450757846158923850f00b7ca6163193ed02587263f66fa934d2cf52801ec
                                                            • Opcode Fuzzy Hash: b974c2f3ea8aad4c3aa75f734db5a636694e435bef09d89c52c2fc79a0bf9def
                                                            • Instruction Fuzzy Hash: D7310530200211ABCB61BF55C889ABF7B69DF41B58F16087BF8145B291EF388D00C7E9
                                                            Function 00498F7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00498E44: lstrlenW.KERNEL32(00000100,?,?,?,00499217,000002C0,00000100,00000100,00000100,?,?,?,00477D87,?,?,000001BC), ref: 00498E69
                                                            • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0049B500,wininet.dll,?), ref: 0049907A
                                                            • RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0049B500,wininet.dll,?), ref: 00499087
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                              • Part of subcall function 00490E4F: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00478E1B), ref: 00490EAA
                                                              • Part of subcall function 00490E4F: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00478E1B,00000000), ref: 00490EC8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close$EnumInfoOpenQuerylstrlen
                                                            • String ID: wininet.dll
                                                            • API String ID: 2680864210-3354682871
                                                            • Opcode ID: d47e507da535790f0ec3ac099f56d1f49cc559a7a6a051652bf8fda3eedf655b
                                                            • Instruction ID: 4e7a1cb7467a3ab9e1670d9d651f8437f9c0fe7cae5f0dce49aa3a878e2431b8
                                                            • Opcode Fuzzy Hash: d47e507da535790f0ec3ac099f56d1f49cc559a7a6a051652bf8fda3eedf655b
                                                            • Instruction Fuzzy Hash: FF314C32C01129EFCF22AF9ACD408AEBF79EF04714B11417EEA1476221C73A4E11DB99
                                                            Function 0049939E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00498E44: lstrlenW.KERNEL32(00000100,?,?,?,00499217,000002C0,00000100,00000100,00000100,?,?,?,00477D87,?,?,000001BC), ref: 00498E69
                                                            • RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 00499483
                                                            • RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 0049949D
                                                              • Part of subcall function 00490BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,0046061A,?,00000000,00020006), ref: 00490C0E
                                                              • Part of subcall function 004914F4: RegSetValueExW.ADVAPI32(00020006,004A0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0045F335,00000000,?,00020006), ref: 00491527
                                                              • Part of subcall function 004914F4: RegDeleteValueW.ADVAPI32(00020006,004A0D10,00000000,?,?,0045F335,00000000,?,00020006,?,004A0D10,00020006,00000000,?,?,?), ref: 00491557
                                                              • Part of subcall function 004914A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,0045F28D,004A0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 004914BB
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Value$Close$CreateDeletelstrlen
                                                            • String ID: %ls\%ls
                                                            • API String ID: 3924016894-2125769799
                                                            • Opcode ID: 821f5cfc253392d6c3e3596028c877e5e9f544603a0d14c2091313a84e239a5e
                                                            • Instruction ID: bb0f590bebb495936ce0763bdcfe13c54de01aaf3ad1497a787e070abfd70a4a
                                                            • Opcode Fuzzy Hash: 821f5cfc253392d6c3e3596028c877e5e9f544603a0d14c2091313a84e239a5e
                                                            • Instruction Fuzzy Hash: B8313772C0512EBF8F129FD9CC4189EBFB9EB04314B1141BBE904A6221D7398E21EB94
                                                            Function 00453A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _memcpy_s
                                                            • String ID: crypt32.dll$wininet.dll
                                                            • API String ID: 2001391462-82500532
                                                            • Opcode ID: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                            • Instruction ID: 047d5ef7923aa4056411f44b407e0c3524806e3e4fb858c4ca18b827b4621f9b
                                                            • Opcode Fuzzy Hash: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
                                                            • Instruction Fuzzy Hash: B7115171600219ABCF08DF19CD8599BBF69EF95295B14802AFC058B312D275EA14CAE4
                                                            Function 004914F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegSetValueExW.ADVAPI32(00020006,004A0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0045F335,00000000,?,00020006), ref: 00491527
                                                            • RegDeleteValueW.ADVAPI32(00020006,004A0D10,00000000,?,?,0045F335,00000000,?,00020006,?,004A0D10,00020006,00000000,?,?,?), ref: 00491557
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Value$Delete
                                                            • String ID: regutil.cpp
                                                            • API String ID: 1738766685-955085611
                                                            • Opcode ID: 4255c3a527a33484e92b9b1fbb3ea52879048967f2121fd7a4cddea2d47b37fc
                                                            • Instruction ID: a52aad6e6c6aab1af89ce9105801b7f41174176c06276a99a629a44ab2ff76c3
                                                            • Opcode Fuzzy Hash: 4255c3a527a33484e92b9b1fbb3ea52879048967f2121fd7a4cddea2d47b37fc
                                                            • Instruction Fuzzy Hash: B611E736911137B7DF214A948C05BAB7E24EB447B0F130277FD02AA2B0D638CD1096EC
                                                            Function 0045DDB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,00477691,00000000,IGNOREDEPENDENCIES,00000000,?,0049B518), ref: 0045DE04
                                                            Strings
                                                            • IGNOREDEPENDENCIES, xrefs: 0045DDBB
                                                            • Failed to copy the property value., xrefs: 0045DE38
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
                                                            • API String ID: 1825529933-1412343224
                                                            • Opcode ID: 96cc60fa23a8e80dca455aa6e7e7cee5c44643fc4942a62272354fc6e6fdf0d8
                                                            • Instruction ID: 3da7ee1873963d3f8a9fd528693b706e811a38fe7cbae418b41651f44432d180
                                                            • Opcode Fuzzy Hash: 96cc60fa23a8e80dca455aa6e7e7cee5c44643fc4942a62272354fc6e6fdf0d8
                                                            • Instruction Fuzzy Hash: 5711E732A00215AFCB215F54DC85FAAB7A6EF54321F21417BEE189F292C7749858C789
                                                            Function 0049563F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00468E97,?,00000001,20000004,00000000,00000000,?,00000000), ref: 0049566E
                                                            • SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00468E97,?), ref: 00495689
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: InfoNamedSecuritySleep
                                                            • String ID: aclutil.cpp
                                                            • API String ID: 2352087905-2159165307
                                                            • Opcode ID: b12e4829a134cc4fe64ca108d1d1d0402925a54ba329a6b6984f711ab81e1b50
                                                            • Instruction ID: 75a59f3b641aa5a5cb23bd2c9f07bf67af64c8671e1df766d7c3308331c59405
                                                            • Opcode Fuzzy Hash: b12e4829a134cc4fe64ca108d1d1d0402925a54ba329a6b6984f711ab81e1b50
                                                            • Instruction Fuzzy Hash: 68015E33801529BBCF239E85DD05E9F7F75EF44754F260166FD0866220C67A9D209BD8
                                                            Function 0045158C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LCMapStringW.KERNEL32(0000007F,00000000,00000000,?,00000000,?,00000000,00000000,?,00000000,00000000,00000000,?,00452318,00000000,00000000), ref: 004515D0
                                                            • GetLastError.KERNEL32(?,00452318,00000000,00000000,?,00000200,?,004952B2,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004515DA
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastString
                                                            • String ID: strutil.cpp
                                                            • API String ID: 3728238275-3612885251
                                                            • Opcode ID: 5cfc40587a745316e24fb4b4ead7469530a1a2e6da2f592550eedad13333137b
                                                            • Instruction ID: ddb07e29886f62dfc7442d44902ce9f9a4394731833d627c440a9a0d4b501b5a
                                                            • Opcode Fuzzy Hash: 5cfc40587a745316e24fb4b4ead7469530a1a2e6da2f592550eedad13333137b
                                                            • Instruction Fuzzy Hash: 37012833941239778B218E9A8C44F5F7AACEF85B72B050226FE10AF262D734DC0087E4
                                                            Function 004657BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CoInitializeEx.OLE32(00000000,00000000), ref: 004657D9
                                                            • CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00465833
                                                            Strings
                                                            • Failed to initialize COM on cache thread., xrefs: 004657E5
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: InitializeUninitialize
                                                            • String ID: Failed to initialize COM on cache thread.
                                                            • API String ID: 3442037557-3629645316
                                                            • Opcode ID: 1c57e8cdb13ebe2f3fe6ae69ee67db3c523845e4ee8572a8d5375877a6b1072d
                                                            • Instruction ID: 80ba0437080a64231a6da2efd23cfdcc0e0e76efaeaadacaab79c665b70f9a2d
                                                            • Opcode Fuzzy Hash: 1c57e8cdb13ebe2f3fe6ae69ee67db3c523845e4ee8572a8d5375877a6b1072d
                                                            • Instruction Fuzzy Hash: 8A018B72600619BFCB119FA5E880DDAFBACFF08354B008126FA08C7221DB34AD148BD8
                                                            Function 00493929 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysAllocString.OLEAUT32(?), ref: 0049396E
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004939A1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$AllocFree
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 344208780-1270936966
                                                            • Opcode ID: 23a996edf0e41079075330f97fcba0d8ec43044919ab0098f8442e61baae6ace
                                                            • Instruction ID: 20398c098844a53d7eaa7d29abaf5d39f8cde2459e6982636c244c888f95eea1
                                                            • Opcode Fuzzy Hash: 23a996edf0e41079075330f97fcba0d8ec43044919ab0098f8442e61baae6ace
                                                            • Instruction Fuzzy Hash: 3901DFB1244215ABDF205E598C08F7B3AD8EF52B66F11003BFD40E7341CABCCD0082A9
                                                            Function 004939AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysAllocString.OLEAUT32(?), ref: 004939F4
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00493A27
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$AllocFree
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 344208780-1270936966
                                                            • Opcode ID: b27f7409de5971b9592f2980af5af1d39f2cb400ee962fc4300d3f8608718ec0
                                                            • Instruction ID: b727c0b619adade1f9914d556ff59163ceb7fbd6e2973d5274c5ad5d1911bef3
                                                            • Opcode Fuzzy Hash: b27f7409de5971b9592f2980af5af1d39f2cb400ee962fc4300d3f8608718ec0
                                                            • Instruction Fuzzy Hash: AC018F75644215B7DF209E959809F6B3ADCDF52766B11003BFC44AB341C6ACDE0086A9
                                                            Function 00493BF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00490F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,004BAAA0,00000000,?,004957E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00490F80
                                                            • RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00493A8E,?), ref: 00493C62
                                                            Strings
                                                            • EnableLUA, xrefs: 00493C34
                                                            • SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00493C0C
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseOpen
                                                            • String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
                                                            • API String ID: 47109696-3551287084
                                                            • Opcode ID: 07513adc4a81a1696bc2d457f730720c496f4d284d68434dda12631bb88114be
                                                            • Instruction ID: 382fb98b960837244cb016099abaea91f35a6d32a6e8cc8bed6b1265bbffabb3
                                                            • Opcode Fuzzy Hash: 07513adc4a81a1696bc2d457f730720c496f4d284d68434dda12631bb88114be
                                                            • Instruction Fuzzy Hash: 92018433911229FFDB109AA4D906BEEFAA8DB15726F2141B6E800B3111D37D5F50D6D8
                                                            Function 00455123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00451104,?,?,00000000), ref: 00455142
                                                            • CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00451104,?,?,00000000), ref: 00455172
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareStringlstrlen
                                                            • String ID: burn.clean.room
                                                            • API String ID: 1433953587-3055529264
                                                            • Opcode ID: 7a50e3aa7054aa962ffeead031bdcede88a03e001e942506cb9cf6efc8e57aab
                                                            • Instruction ID: 7e8c2e7384e55926807c42cec8f5b32c95cf71cb4872b244566c12ef212b9d0c
                                                            • Opcode Fuzzy Hash: 7a50e3aa7054aa962ffeead031bdcede88a03e001e942506cb9cf6efc8e57aab
                                                            • Instruction Fuzzy Hash: 5F016272900A247F87308B48AD94A73BFACEB197A1B104227F905D3B11D7749C55CBE9
                                                            Function 004968B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysFreeString.OLEAUT32(?), ref: 0049690F
                                                              • Part of subcall function 00498713: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00498820
                                                              • Part of subcall function 00498713: GetLastError.KERNEL32 ref: 0049882A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Time$ErrorFileFreeLastStringSystem
                                                            • String ID: atomutil.cpp$clbcatq.dll
                                                            • API String ID: 211557998-3749116663
                                                            • Opcode ID: c70bc245f45b40a6b842c6ee26a00a725a2c94cdce953ccf0a999d81e7edb02c
                                                            • Instruction ID: 42254dda29eb788a7ab4bf3380d08795641dcca42789c92bb1e5e7c0eeaed7a6
                                                            • Opcode Fuzzy Hash: c70bc245f45b40a6b842c6ee26a00a725a2c94cdce953ccf0a999d81e7edb02c
                                                            • Instruction Fuzzy Hash: B30162B190122AFB8F20AF95D841C5EFFA8EB15365B62417FF904A7210D3795E10E7E8
                                                            Function 00456522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(?), ref: 00456534
                                                              • Part of subcall function 00490ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00455EB2,00000000), ref: 00490AE0
                                                              • Part of subcall function 00490ACC: GetProcAddress.KERNEL32(00000000), ref: 00490AE7
                                                              • Part of subcall function 00490ACC: GetLastError.KERNEL32(?,?,?,00455EB2,00000000), ref: 00490AFE
                                                              • Part of subcall function 00455CE2: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00455D68
                                                            Strings
                                                            • Failed to get 64-bit folder., xrefs: 00456557
                                                            • Failed to set variant value., xrefs: 00456571
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
                                                            • String ID: Failed to get 64-bit folder.$Failed to set variant value.
                                                            • API String ID: 3109562764-2681622189
                                                            • Opcode ID: c2d4d4a20a39a133a061777e05ceb0489f5b467b26811a96be06b3ccc64ac3fa
                                                            • Instruction ID: 0ef36b15a83ae00408d79c5e4774634463b09eb0996ec418ab16adefee3a4e98
                                                            • Opcode Fuzzy Hash: c2d4d4a20a39a133a061777e05ceb0489f5b467b26811a96be06b3ccc64ac3fa
                                                            • Instruction Fuzzy Hash: E0018F32C4122CBBCF22AB90ED06A9E7E38EB00762F614167FC0067146E6399F54D6D8
                                                            Function 004533C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,004510DD,?,00000000), ref: 004533E8
                                                            • GetLastError.KERNEL32(?,?,?,?,004510DD,?,00000000), ref: 004533FF
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastModuleName
                                                            • String ID: pathutil.cpp
                                                            • API String ID: 2776309574-741606033
                                                            • Opcode ID: 08f6bafc82959ca5d7d3e612b74af6636657a9bcfe6473ce2dcb708be2af7a25
                                                            • Instruction ID: da97cc57440f0355b8c7fb04daba86d559f88f525a904df886fd148984f67189
                                                            • Opcode Fuzzy Hash: 08f6bafc82959ca5d7d3e612b74af6636657a9bcfe6473ce2dcb708be2af7a25
                                                            • Instruction Fuzzy Hash: 76F0C873A405316787225A966C45E4BEA58DB42BF3B124137FD04BB212D678DD0442E8
                                                            Function 0047E30F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0047EBD2
                                                              • Part of subcall function 00481380: RaiseException.KERNEL32(?,?,?,0047EBF4,?,00000000,00000000,?,?,?,?,?,0047EBF4,?,004B7EC8), ref: 004813DF
                                                            • __CxxThrowException@8.LIBVCRUNTIME ref: 0047EBEF
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Exception@8Throw$ExceptionRaise
                                                            • String ID: Unknown exception
                                                            • API String ID: 3476068407-410509341
                                                            • Opcode ID: 835948c29c1a724d2ccba73eeb132647bab9c7059262012df93277eb606336ea
                                                            • Instruction ID: dc9fe150262a89e1cf67dca91e03f133ae3507dadcde51d0c40c69a39210177a
                                                            • Opcode Fuzzy Hash: 835948c29c1a724d2ccba73eeb132647bab9c7059262012df93277eb606336ea
                                                            • Instruction Fuzzy Hash: A0F0F93450020D76CB00FBA7DC05DDD371C8D04304B508BA7FC18965D1EB38F915829D
                                                            Function 00494A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetFileSizeEx.KERNEL32(00000000,00000000,00000000,774D34C0,?,?,?,0045BA1D,?,?,?,00000000,00000000), ref: 00494A1D
                                                            • GetLastError.KERNEL32(?,?,?,0045BA1D,?,?,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00494A27
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastSize
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 464720113-2967768451
                                                            • Opcode ID: f04a8310afcc075e529658fe8be00ea3903776b122fe13248097f6f5fa76a38c
                                                            • Instruction ID: 6e174761be09c720ba0bdd0bfeb1809a80822f8c7bce57deb470fea5ccfdb864
                                                            • Opcode Fuzzy Hash: f04a8310afcc075e529658fe8be00ea3903776b122fe13248097f6f5fa76a38c
                                                            • Instruction Fuzzy Hash: B0F0A472940136AB9B149F85D90595EFFACEF54760B01412BFD44A7300E774AD0187D8
                                                            Function 004931EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysAllocString.OLEAUT32(?), ref: 00493200
                                                            • SysFreeString.OLEAUT32(00000000), ref: 00493230
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$AllocFree
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 344208780-1270936966
                                                            • Opcode ID: 8a86331974efc14edb75bc82fac74f411de28901a2a6c1f35a7f363c2d997c04
                                                            • Instruction ID: 1b3a334d8e16b42c93a43a2b6b6722d248b910d55ce27bcd0c8f8bfd98896d17
                                                            • Opcode Fuzzy Hash: 8a86331974efc14edb75bc82fac74f411de28901a2a6c1f35a7f363c2d997c04
                                                            • Instruction Fuzzy Hash: 6CF0B431101654A7CB315F84AC08F6F7BE8EB51B62F25407BFC0457310C7789E1196E9
                                                            Function 00493498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SysAllocString.OLEAUT32(?), ref: 004934AD
                                                            • SysFreeString.OLEAUT32(00000000), ref: 004934DD
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: String$AllocFree
                                                            • String ID: xmlutil.cpp
                                                            • API String ID: 344208780-1270936966
                                                            • Opcode ID: e1a1586f9d0af8b9d1bd23f4c21260e40ef500f0d6ea399cd7e93a99674ae113
                                                            • Instruction ID: b5bc919f014ad191679e59550553bf0ab2964dae18afbf51711bd8b656af047c
                                                            • Opcode Fuzzy Hash: e1a1586f9d0af8b9d1bd23f4c21260e40ef500f0d6ea399cd7e93a99674ae113
                                                            • Instruction Fuzzy Hash: F3F09031241214A7CB325E44AD08E5B7AA8EB52B62B12413BFC0457210C779DE0096E9
                                                            Function 00490E07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00490E28
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000001.00000002.1502285044.0000000000451000.00000020.00000001.01000000.00000003.sdmp, Offset: 00450000, based on PE: true
                                                            • Associated: 00000001.00000002.1502265514.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502327739.000000000049B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502366929.00000000004BA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000001.00000002.1502384362.00000000004BD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_1_2_450000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc
                                                            • String ID: AdvApi32.dll$RegDeleteKeyExW
                                                            • API String ID: 190572456-850864035
                                                            • Opcode ID: 6735106a7c73625bbb5b24a8738e2032aea2104c22b6c2d5f14453c055615203
                                                            • Instruction ID: 9ebac30b5a17fe9e62de7cbcfa6417f6e4dd5099ba139360773804d27d21bbeb
                                                            • Opcode Fuzzy Hash: 6735106a7c73625bbb5b24a8738e2032aea2104c22b6c2d5f14453c055615203
                                                            • Instruction Fuzzy Hash: 2DE0EC719013259BCF119F15BC05B867F90E720759F114336E80596270D3F94C55CBEE

                                                            Executed Functions

                                                            Function 00C61070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00C633C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00C610DD,?,00000000), ref: 00C633E8
                                                            • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00C610F6
                                                              • Part of subcall function 00C61175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00C6111A,cabinet.dll,00000009,?,?,00000000), ref: 00C61186
                                                              • Part of subcall function 00C61175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00C6111A,cabinet.dll,00000009,?,?,00000000), ref: 00C61191
                                                              • Part of subcall function 00C61175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00C6119F
                                                              • Part of subcall function 00C61175: GetLastError.KERNEL32(?,?,?,?,?,00C6111A,cabinet.dll,00000009,?,?,00000000), ref: 00C611BA
                                                              • Part of subcall function 00C61175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00C611C2
                                                              • Part of subcall function 00C61175: GetLastError.KERNEL32(?,?,?,?,?,00C6111A,cabinet.dll,00000009,?,?,00000000), ref: 00C611D7
                                                            • CloseHandle.KERNEL32(?,?,?,?,00CAB4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00C61131
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                            • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                            • API String ID: 3687706282-3151496603
                                                            • Opcode ID: af6029312bb2a2c4b8b265cd36a41fa666c388c14a7789d712ef0ebc38e81c4d
                                                            • Instruction ID: d26dfda34285a06430593295dff25361d321c4522b2e2ed385107c7a11ce184d
                                                            • Opcode Fuzzy Hash: af6029312bb2a2c4b8b265cd36a41fa666c388c14a7789d712ef0ebc38e81c4d
                                                            • Instruction Fuzzy Hash: 1C2191B190021DAFCF209FA5CC89BDEBBB8EF0A719F184115FA11B7292D7705D049BA0
                                                            Function 00C9FEC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132threadtimeCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00CCB5FC,00000000,?,?,?,?,00C812CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00C9FEF4
                                                            • GetCurrentProcessId.KERNEL32(00000000,?,00C812CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00C9FF04
                                                            • GetCurrentThreadId.KERNEL32 ref: 00C9FF0D
                                                            • GetLocalTime.KERNEL32(8007139F,?,00C812CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00C9FF23
                                                            • LeaveCriticalSection.KERNEL32(00CCB5FC,00C812CF,?,00000000,0000FDE9,?,00C812CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00CA001A
                                                            Strings
                                                            • %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00C9FFC0
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                            • String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
                                                            • API String ID: 296830338-59366893
                                                            • Opcode ID: 7b40507adac6a61c22dd63a0ce3ee3b7e71b01c0fa4dc29b80e8692e2ced5f7f
                                                            • Instruction ID: bc1b54931bba12642522234c0c4bdd409a1b2954f185e416da9fc35550ed7557
                                                            • Opcode Fuzzy Hash: 7b40507adac6a61c22dd63a0ce3ee3b7e71b01c0fa4dc29b80e8692e2ced5f7f
                                                            • Instruction Fuzzy Hash: FC419D72E0021AABCF219FE4D849BBEB7B8EB09B55F100029F911E7251D7348E41DBA1
                                                            Function 00C7A0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • Failed to copy working folder., xrefs: 00C7A116
                                                            • Failed to calculate working folder to ensure it exists., xrefs: 00C7A0D8
                                                            • Failed create working folder., xrefs: 00C7A0EE
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentDirectoryErrorLastProcessWindows
                                                            • String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                            • API String ID: 3841436932-2072961686
                                                            • Opcode ID: 67739fbc0944397dee5e30eb3887141ead5b9d2f13ad003449e5b1cb0f8ab658
                                                            • Instruction ID: a6ab08036372bfa078054efdf56e985197b923207d07062ee0dff8770c75d1f4
                                                            • Opcode Fuzzy Hash: 67739fbc0944397dee5e30eb3887141ead5b9d2f13ad003449e5b1cb0f8ab658
                                                            • Instruction Fuzzy Hash: 1901F232901629FB9B339B55DC0ACAEBB79DFC5B60F20C265F80476211DB319F40B682
                                                            Function 00C6F9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 0 c6f9e3-c6fa14 call ca39af 3 c6fa16 0->3 4 c6fa18-c6fa1a 0->4 3->4 5 c6fa2e-c6fa47 call ca32f3 4->5 6 c6fa1c-c6fa29 call ca0237 4->6 12 c6fa53-c6fa68 call ca32f3 5->12 13 c6fa49-c6fa4e 5->13 11 c6ff16-c6ff1b 6->11 14 c6ff23-c6ff28 11->14 15 c6ff1d-c6ff1f 11->15 24 c6fa74-c6fa81 call c6ea42 12->24 25 c6fa6a-c6fa6f 12->25 16 c6ff0d-c6ff14 call ca0237 13->16 18 c6ff30-c6ff35 14->18 19 c6ff2a-c6ff2c 14->19 15->14 30 c6ff15 16->30 22 c6ff37-c6ff39 18->22 23 c6ff3d-c6ff41 18->23 19->18 22->23 27 c6ff43-c6ff46 call ca5636 23->27 28 c6ff4b-c6ff52 23->28 33 c6fa83-c6fa88 24->33 34 c6fa8d-c6faa2 call ca32f3 24->34 25->16 27->28 30->11 33->16 37 c6faa4-c6faa9 34->37 38 c6faae-c6fac0 call ca4c97 34->38 37->16 41 c6fac2-c6faca 38->41 42 c6facf-c6fae4 call ca32f3 38->42 43 c6fd99-c6fda2 call ca0237 41->43 47 c6fae6-c6faeb 42->47 48 c6faf0-c6fb05 call ca32f3 42->48 43->30 47->16 52 c6fb07-c6fb0c 48->52 53 c6fb11-c6fb23 call ca3505 48->53 52->16 56 c6fb25-c6fb2a 53->56 57 c6fb2f-c6fb45 call ca39af 53->57 56->16 60 c6fdf4-c6fe0e call c6ecbe 57->60 61 c6fb4b-c6fb4d 57->61 68 c6fe10-c6fe15 60->68 69 c6fe1a-c6fe32 call ca39af 60->69 62 c6fb4f-c6fb54 61->62 63 c6fb59-c6fb6e call ca3505 61->63 62->16 70 c6fb70-c6fb75 63->70 71 c6fb7a-c6fb8f call ca32f3 63->71 68->16 75 c6fefc-c6fefd call c6f0f8 69->75 76 c6fe38-c6fe3a 69->76 70->16 78 c6fb91-c6fb93 71->78 79 c6fb9f-c6fbb4 call ca32f3 71->79 86 c6ff02-c6ff06 75->86 80 c6fe46-c6fe64 call ca32f3 76->80 81 c6fe3c-c6fe41 76->81 78->79 83 c6fb95-c6fb9a 78->83 90 c6fbb6-c6fbb8 79->90 91 c6fbc4-c6fbd9 call ca32f3 79->91 92 c6fe66-c6fe6b 80->92 93 c6fe70-c6fe88 call ca32f3 80->93 81->16 83->16 86->30 89 c6ff08 86->89 89->16 90->91 94 c6fbba-c6fbbf 90->94 101 c6fbdb-c6fbdd 91->101 102 c6fbe9-c6fbfe call ca32f3 91->102 92->16 99 c6fe95-c6fead call ca32f3 93->99 100 c6fe8a-c6fe8c 93->100 94->16 109 c6feaf-c6feb1 99->109 110 c6feba-c6fed2 call ca32f3 99->110 100->99 103 c6fe8e-c6fe93 100->103 101->102 104 c6fbdf-c6fbe4 101->104 111 c6fc00-c6fc02 102->111 112 c6fc0e-c6fc23 call ca32f3 102->112 103->16 104->16 109->110 116 c6feb3-c6feb8 109->116 119 c6fed4-c6fed9 110->119 120 c6fedb-c6fef3 call ca32f3 110->120 111->112 113 c6fc04-c6fc09 111->113 121 c6fc25-c6fc27 112->121 122 c6fc33-c6fc48 call ca32f3 112->122 113->16 116->16 119->16 120->75 128 c6fef5-c6fefa 120->128 121->122 124 c6fc29-c6fc2e 121->124 129 c6fc4a-c6fc4c 122->129 130 c6fc58-c6fc6d call ca32f3 122->130 124->16 128->16 129->130 131 c6fc4e-c6fc53 129->131 134 c6fc6f-c6fc71 130->134 135 c6fc7d-c6fc92 call ca32f3 130->135 131->16 134->135 137 c6fc73-c6fc78 134->137 139 c6fc94-c6fc96 135->139 140 c6fca2-c6fcba call ca32f3 135->140 137->16 139->140 141 c6fc98-c6fc9d 139->141 144 c6fcbc-c6fcbe 140->144 145 c6fcca-c6fce2 call ca32f3 140->145 141->16 144->145 146 c6fcc0-c6fcc5 144->146 149 c6fce4-c6fce6 145->149 150 c6fcf2-c6fd07 call ca32f3 145->150 146->16 149->150 152 c6fce8-c6fced 149->152 154 c6fda7-c6fda9 150->154 155 c6fd0d-c6fd2a CompareStringW 150->155 152->16 156 c6fdb4-c6fdb6 154->156 157 c6fdab-c6fdb2 154->157 158 c6fd34-c6fd49 CompareStringW 155->158 159 c6fd2c-c6fd32 155->159 160 c6fdc2-c6fdda call ca3505 156->160 161 c6fdb8-c6fdbd 156->161 157->156 163 c6fd57-c6fd6c CompareStringW 158->163 164 c6fd4b-c6fd55 158->164 162 c6fd75-c6fd7a 159->162 160->60 170 c6fddc-c6fdde 160->170 161->16 162->156 166 c6fd6e 163->166 167 c6fd7c-c6fd94 call c63821 163->167 164->162 166->162 167->43 172 c6fde0-c6fde5 170->172 173 c6fdea 170->173 172->16 173->60
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: StringVariant$AllocClearFreeInit
                                                            • String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
                                                            • API String ID: 760788290-2956246334
                                                            • Opcode ID: 3b4bdbfb5150408e2250ebd426759e43fb8dcb5a27af0063ac783b77d87e608d
                                                            • Instruction ID: 0136ef30fa276fc17d001005386eb53399c9389c6d621b84993f8e3a2be4cd66
                                                            • Opcode Fuzzy Hash: 3b4bdbfb5150408e2250ebd426759e43fb8dcb5a27af0063ac783b77d87e608d
                                                            • Instruction Fuzzy Hash: 6AE12A32E44276BBCB31AAA4DCE2FEEB6A46B01710F150239FD11F7151C761AE52A7C1
                                                            Function 00C6B48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 174 c6b48b-c6b500 call c8f8e0 * 2 179 c6b502-c6b50c GetLastError 174->179 180 c6b538-c6b53e 174->180 181 c6b50e-c6b517 179->181 182 c6b519 179->182 183 c6b542-c6b554 SetFilePointerEx 180->183 184 c6b540 180->184 181->182 185 c6b520-c6b52d call c63821 182->185 186 c6b51b 182->186 187 c6b556-c6b560 GetLastError 183->187 188 c6b588-c6b5a2 ReadFile 183->188 184->183 204 c6b532-c6b533 185->204 186->185 192 c6b562-c6b56b 187->192 193 c6b56d 187->193 189 c6b5a4-c6b5ae GetLastError 188->189 190 c6b5d9-c6b5e0 188->190 194 c6b5b0-c6b5b9 189->194 195 c6b5bb 189->195 197 c6b5e6-c6b5ef 190->197 198 c6bbd7-c6bbeb call c63821 190->198 192->193 199 c6b574-c6b586 call c63821 193->199 200 c6b56f 193->200 194->195 202 c6b5c2-c6b5d4 call c63821 195->202 203 c6b5bd 195->203 197->198 206 c6b5f5-c6b605 SetFilePointerEx 197->206 216 c6bbf0 198->216 199->204 200->199 202->204 203->202 209 c6bbf1-c6bbf7 call ca0237 204->209 211 c6b607-c6b611 GetLastError 206->211 212 c6b63c-c6b654 ReadFile 206->212 227 c6bbf8-c6bc0a call c8e06f 209->227 218 c6b613-c6b61c 211->218 219 c6b61e 211->219 213 c6b656-c6b660 GetLastError 212->213 214 c6b68b-c6b692 212->214 224 c6b662-c6b66b 213->224 225 c6b66d 213->225 220 c6bbbc-c6bbd5 call c63821 214->220 221 c6b698-c6b6a2 214->221 216->209 218->219 222 c6b625-c6b632 call c63821 219->222 223 c6b620 219->223 220->216 221->220 228 c6b6a8-c6b6cb SetFilePointerEx 221->228 222->212 223->222 224->225 231 c6b674-c6b681 call c63821 225->231 232 c6b66f 225->232 234 c6b702-c6b71a ReadFile 228->234 235 c6b6cd-c6b6d7 GetLastError 228->235 231->214 232->231 242 c6b751-c6b769 ReadFile 234->242 243 c6b71c-c6b726 GetLastError 234->243 240 c6b6e4 235->240 241 c6b6d9-c6b6e2 235->241 247 c6b6e6 240->247 248 c6b6eb-c6b6f8 call c63821 240->248 241->240 245 c6b7a0-c6b7bb SetFilePointerEx 242->245 246 c6b76b-c6b775 GetLastError 242->246 249 c6b733 243->249 250 c6b728-c6b731 243->250 254 c6b7f5-c6b814 ReadFile 245->254 255 c6b7bd-c6b7c7 GetLastError 245->255 251 c6b777-c6b780 246->251 252 c6b782 246->252 247->248 248->234 256 c6b735 249->256 257 c6b73a-c6b747 call c63821 249->257 250->249 251->252 261 c6b784 252->261 262 c6b789-c6b796 call c63821 252->262 259 c6bb7d-c6bb87 GetLastError 254->259 260 c6b81a-c6b81c 254->260 264 c6b7d4 255->264 265 c6b7c9-c6b7d2 255->265 256->257 257->242 271 c6bb94 259->271 272 c6bb89-c6bb92 259->272 269 c6b81d-c6b824 260->269 261->262 262->245 266 c6b7d6 264->266 267 c6b7db-c6b7eb call c63821 264->267 265->264 266->267 267->254 274 c6b82a-c6b836 269->274 275 c6bb58-c6bb75 call c63821 269->275 277 c6bb96 271->277 278 c6bb9b-c6bbb1 call c63821 271->278 272->271 281 c6b841-c6b84a 274->281 282 c6b838-c6b83f 274->282 290 c6bb7a-c6bb7b 275->290 277->278 289 c6bbb2-c6bbba call ca0237 278->289 287 c6b850-c6b876 ReadFile 281->287 288 c6bb1b-c6bb32 call c63821 281->288 282->281 285 c6b884-c6b88b 282->285 292 c6b8b4-c6b8cb call c6394f 285->292 293 c6b88d-c6b8af call c63821 285->293 287->259 291 c6b87c-c6b882 287->291 300 c6bb37-c6bb3d call ca0237 288->300 289->227 290->289 291->269 304 c6b8ef-c6b904 SetFilePointerEx 292->304 305 c6b8cd-c6b8ea call c63821 292->305 293->290 310 c6bb43-c6bb44 300->310 308 c6b906-c6b910 GetLastError 304->308 309 c6b944-c6b969 ReadFile 304->309 305->209 314 c6b912-c6b91b 308->314 315 c6b91d 308->315 311 c6b9a0-c6b9ac 309->311 312 c6b96b-c6b975 GetLastError 309->312 316 c6bb45-c6bb47 310->316 319 c6b9ae-c6b9ca call c63821 311->319 320 c6b9cf-c6b9d3 311->320 317 c6b977-c6b980 312->317 318 c6b982 312->318 314->315 321 c6b924-c6b934 call c63821 315->321 322 c6b91f 315->322 316->227 323 c6bb4d-c6bb53 call c63a16 316->323 317->318 324 c6b984 318->324 325 c6b989-c6b99e call c63821 318->325 319->300 328 c6b9d5-c6ba09 call c63821 call ca0237 320->328 329 c6ba0e-c6ba21 call ca4a05 320->329 340 c6b939-c6b93f call ca0237 321->340 322->321 323->227 324->325 325->340 328->316 343 c6ba23-c6ba28 329->343 344 c6ba2d-c6ba37 329->344 340->310 343->340 347 c6ba41-c6ba49 344->347 348 c6ba39-c6ba3f 344->348 350 c6ba55-c6ba58 347->350 351 c6ba4b-c6ba53 347->351 349 c6ba5a-c6baba call c6394f 348->349 354 c6bade-c6baff call c8f360 call c6b208 349->354 355 c6babc-c6bad8 call c63821 349->355 350->349 351->349 354->316 362 c6bb01-c6bb11 call c63821 354->362 355->354 362->288
                                                            APIs
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 00C6B502
                                                            • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B550
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 00C6B556
                                                            • ReadFile.KERNELBASE(00000000,00C64461,00000040,?,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B59E
                                                            • GetLastError.KERNEL32(?,?,?,00000000,7765C3F0,00000000), ref: 00C6B5A4
                                                            • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B601
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B607
                                                            • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B650
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B656
                                                            • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B6C7
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B6CD
                                                            • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B716
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B71C
                                                            • ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B765
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B76B
                                                            • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B7B7
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B7BD
                                                              • Part of subcall function 00C6394F: GetProcessHeap.KERNEL32(?,000001C7,?,00C62274,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63960
                                                              • Part of subcall function 00C6394F: RtlAllocateHeap.NTDLL(00000000,?,00C62274,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63967
                                                            • ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B810
                                                            • ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B872
                                                            • SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B8FC
                                                            • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,7765C3F0,00000000), ref: 00C6B906
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
                                                            • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
                                                            • API String ID: 3411815225-695169583
                                                            • Opcode ID: 770a9f066c3e74eb51d734cef711c36d74bd8d0e6ed9d2d1c24f4132bb86e9ea
                                                            • Instruction ID: ee1d424d8f0d38c476b0b0347cb9b5dfa03acfa624f1457d0ca75486dbe98bbc
                                                            • Opcode Fuzzy Hash: 770a9f066c3e74eb51d734cef711c36d74bd8d0e6ed9d2d1c24f4132bb86e9ea
                                                            • Instruction Fuzzy Hash: 2B121572A80236ABDB309B558CC5FEA76A4EF45714F0141A5FE04FB281E7719E80DBE4
                                                            Function 00C80D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306synchronizationCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 365 c80d16-c80d2d SetEvent 366 c80d6f-c80d7d WaitForSingleObject 365->366 367 c80d2f-c80d39 GetLastError 365->367 368 c80d7f-c80d89 GetLastError 366->368 369 c80db4-c80dbf ResetEvent 366->369 370 c80d3b-c80d44 367->370 371 c80d46 367->371 372 c80d8b-c80d94 368->372 373 c80d96 368->373 374 c80df9-c80dff 369->374 375 c80dc1-c80dcb GetLastError 369->375 370->371 376 c80d48 371->376 377 c80d4d-c80d5d call c63821 371->377 372->373 380 c80d98 373->380 381 c80d9d-c80db2 call c63821 373->381 378 c80e01-c80e04 374->378 379 c80e32-c80e4b call c621ac 374->379 382 c80dd8 375->382 383 c80dcd-c80dd6 375->383 376->377 396 c80d62-c80d6a call ca0237 377->396 385 c80e28-c80e2d 378->385 386 c80e06-c80e23 call c63821 378->386 399 c80e4d-c80e5e call ca0237 379->399 400 c80e63-c80e6e SetEvent 379->400 380->381 381->396 389 c80dda 382->389 390 c80ddf-c80df4 call c63821 382->390 383->382 393 c810e8-c810ed 385->393 405 c810de-c810e4 call ca0237 386->405 389->390 390->396 401 c810ef 393->401 402 c810f2-c810f8 393->402 396->393 419 c810e5-c810e7 399->419 407 c80ea8-c80eb6 WaitForSingleObject 400->407 408 c80e70-c80e7a GetLastError 400->408 401->402 405->419 410 c80eb8-c80ec2 GetLastError 407->410 411 c80ef0-c80efb ResetEvent 407->411 414 c80e7c-c80e85 408->414 415 c80e87 408->415 416 c80ecf 410->416 417 c80ec4-c80ecd 410->417 420 c80efd-c80f07 GetLastError 411->420 421 c80f35-c80f3c 411->421 414->415 422 c80e89 415->422 423 c80e8e-c80ea3 call c63821 415->423 427 c80ed1 416->427 428 c80ed6-c80eeb call c63821 416->428 417->416 419->393 429 c80f09-c80f12 420->429 430 c80f14 420->430 425 c80fab-c80fce CreateFileW 421->425 426 c80f3e-c80f41 421->426 422->423 440 c810dd 423->440 432 c8100b-c8101f SetFilePointerEx 425->432 433 c80fd0-c80fda GetLastError 425->433 434 c80f6e-c80f72 call c6394f 426->434 435 c80f43-c80f46 426->435 427->428 428->440 429->430 437 c80f1b-c80f30 call c63821 430->437 438 c80f16 430->438 446 c81059-c81064 SetEndOfFile 432->446 447 c81021-c8102b GetLastError 432->447 441 c80fdc-c80fe5 433->441 442 c80fe7 433->442 458 c80f77-c80f7c 434->458 443 c80f48-c80f4b 435->443 444 c80f67-c80f69 435->444 437->440 438->437 440->405 441->442 452 c80fe9 442->452 453 c80fee-c81001 call c63821 442->453 454 c80f5d-c80f62 443->454 455 c80f4d-c80f53 443->455 444->393 450 c8109b-c810a8 SetFilePointerEx 446->450 451 c81066-c81070 GetLastError 446->451 456 c81038 447->456 457 c8102d-c81036 447->457 450->419 462 c810aa-c810b4 GetLastError 450->462 459 c8107d 451->459 460 c81072-c8107b 451->460 452->453 453->432 454->419 455->454 465 c8103a 456->465 466 c8103f-c81054 call c63821 456->466 457->456 463 c80f9d-c80fa6 458->463 464 c80f7e-c80f98 call c63821 458->464 468 c8107f 459->468 469 c81084-c81099 call c63821 459->469 460->459 471 c810c1 462->471 472 c810b6-c810bf 462->472 463->419 464->440 465->466 466->440 468->469 469->440 477 c810c8-c810d8 call c63821 471->477 478 c810c3 471->478 472->471 477->440 478->477
                                                            APIs
                                                            • SetEvent.KERNEL32(?,?,?,?,?,00C808BC,?,?), ref: 00C80D25
                                                            • GetLastError.KERNEL32(?,?,?,?,00C808BC,?,?), ref: 00C80D2F
                                                            • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00C808BC,?,?), ref: 00C80D74
                                                            • GetLastError.KERNEL32(?,?,?,?,00C808BC,?,?), ref: 00C80D7F
                                                            • ResetEvent.KERNEL32(?,?,?,?,?,00C808BC,?,?), ref: 00C80DB7
                                                            • GetLastError.KERNEL32(?,?,?,?,00C808BC,?,?), ref: 00C80DC1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Event$ObjectResetSingleWait
                                                            • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 1865021742-2104912459
                                                            • Opcode ID: 6287eb472beaf31d9be6bef6a430600f90e6f1bdd857f67571fbe32149188e27
                                                            • Instruction ID: ed58d1920fb89158c01b05036d7a3c7fc7759519a94edc12ef164b1e88b0646a
                                                            • Opcode Fuzzy Hash: 6287eb472beaf31d9be6bef6a430600f90e6f1bdd857f67571fbe32149188e27
                                                            • Instruction Fuzzy Hash: 82914A73A80632B7D33136A58D4AB6B2994BF05B28F224322FE60BF2C1D751DC0097D9
                                                            Function 00C65195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 482 c65195-c65243 call c8f8e0 * 2 GetModuleHandleW call ca04f8 call ca06ae call c6120a 493 c65245 482->493 494 c65259-c6526a call c642d7 482->494 496 c6524a-c65254 call ca0237 493->496 499 c65273-c6528f call c65618 CoInitializeEx 494->499 500 c6526c-c65271 494->500 503 c654d4-c654db 496->503 510 c65291-c65296 499->510 511 c65298-c652a4 call c9fcae 499->511 500->496 504 c654dd-c654e3 call ca5636 503->504 505 c654e8-c654ea 503->505 504->505 508 c654ec-c654f3 505->508 509 c654fa-c65518 call c6d82f call c7a8d6 call c7ab24 505->509 508->509 512 c654f5 call c741ec 508->512 532 c65546-c65559 call c64fa4 509->532 533 c6551a-c65522 509->533 510->496 519 c652a6 511->519 520 c652b8-c652c7 call ca0e07 511->520 512->509 522 c652ab-c652b3 call ca0237 519->522 527 c652d0-c652df call ca2af7 520->527 528 c652c9-c652ce 520->528 522->503 538 c652e1-c652e6 527->538 539 c652e8-c652f7 call ca3565 527->539 528->522 543 c65560-c65567 532->543 544 c6555b call ca3a35 532->544 533->532 536 c65524-c65527 533->536 536->532 537 c65529-c65544 call c7434c call c65602 536->537 537->532 538->522 551 c65300-c6531f GetVersionExW 539->551 552 c652f9-c652fe 539->552 548 c6556e-c65575 543->548 549 c65569 call ca2efe 543->549 544->543 554 c65577 call ca1479 548->554 555 c6557c-c65583 548->555 549->548 559 c65321-c6532b GetLastError 551->559 560 c65359-c6539e call c633c7 call c65602 551->560 552->522 554->555 556 c65585 call c9fdbd 555->556 557 c6558a-c6558c 555->557 556->557 564 c65594-c6559b 557->564 565 c6558e CoUninitialize 557->565 566 c6532d-c65336 559->566 567 c65338 559->567 584 c653a0-c653ab call ca5636 560->584 585 c653b1-c653c1 call c7752a 560->585 569 c655d6-c655df call ca0113 564->569 570 c6559d-c6559f 564->570 565->564 566->567 571 c6533f-c65354 call c63821 567->571 572 c6533a 567->572 582 c655e6-c655ff call ca0802 call c8e06f 569->582 583 c655e1 call c645ee 569->583 576 c655a5-c655ab 570->576 577 c655a1-c655a3 570->577 571->522 572->571 581 c655ad-c655c6 call c73d85 call c65602 576->581 577->581 581->569 603 c655c8-c655d5 call c65602 581->603 583->582 584->585 597 c653c3 585->597 598 c653cd-c653d6 585->598 597->598 600 c6549e-c654b4 call c64d39 598->600 601 c653dc-c653df 598->601 617 c654b6 600->617 618 c654c0-c654d2 600->618 604 c65476-c65489 call c64ae5 601->604 605 c653e5-c653e8 601->605 603->569 616 c6548e-c65492 604->616 609 c6544e-c6546a call c648ef 605->609 610 c653ea-c653ed 605->610 609->618 624 c6546c 609->624 614 c65426-c65442 call c64a88 610->614 615 c653ef-c653f2 610->615 614->618 628 c65444 614->628 620 c653f4-c653f9 615->620 621 c65403-c65416 call c64c86 615->621 616->618 622 c65494 616->622 617->618 618->503 620->621 621->618 629 c6541c 621->629 622->600 624->604 628->609 629->614
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00C65217
                                                              • Part of subcall function 00CA04F8: InitializeCriticalSection.KERNEL32(00CCB5FC,?,00C65223,00000000,?,?,?,?,?,?), ref: 00CA050F
                                                              • Part of subcall function 00C6120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00C6523F,00000000,?), ref: 00C61248
                                                              • Part of subcall function 00C6120A: GetLastError.KERNEL32(?,?,?,00C6523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00C61252
                                                            • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00C65285
                                                              • Part of subcall function 00CA0E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00CA0E28
                                                            • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00C65317
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00C65321
                                                            • CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C6558E
                                                            Strings
                                                            • Failed to run per-user mode., xrefs: 00C65494
                                                            • engine.cpp, xrefs: 00C65345
                                                            • Failed to run RunOnce mode., xrefs: 00C6541C
                                                            • Failed to initialize Cryputil., xrefs: 00C652A6
                                                            • 3.11.1.2318, xrefs: 00C65384
                                                            • Failed to run untrusted mode., xrefs: 00C654B6
                                                            • Failed to run embedded mode., xrefs: 00C65444
                                                            • Failed to run per-machine mode., xrefs: 00C6546C
                                                            • Failed to initialize core., xrefs: 00C653C3
                                                            • Failed to initialize XML util., xrefs: 00C652F9
                                                            • Failed to initialize Regutil., xrefs: 00C652C9
                                                            • Failed to initialize Wiutil., xrefs: 00C652E1
                                                            • Failed to initialize COM., xrefs: 00C65291
                                                            • Failed to get OS info., xrefs: 00C6534F
                                                            • Failed to initialize engine state., xrefs: 00C6526C
                                                            • Failed to parse command line., xrefs: 00C65245
                                                            • Invalid run mode., xrefs: 00C653F9
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                            • String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
                                                            • API String ID: 3262001429-510904028
                                                            • Opcode ID: ee73c4e6dc50c4bef1300596f03fbd20fa3a3cadbca09efbbfcf1bcdf67c162b
                                                            • Instruction ID: cc5781039ea3449587478828cc9195fa0458c6d7bbf5fcdf0e6796ce45c2de41
                                                            • Opcode Fuzzy Hash: ee73c4e6dc50c4bef1300596f03fbd20fa3a3cadbca09efbbfcf1bcdf67c162b
                                                            • Instruction Fuzzy Hash: 18B1C672D40A299BDB31AF64CCD6BED76B4AF05714F2001E5F909A6251DB309E80EB91
                                                            Function 00C7752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 630 c7752a-c7756f call c8f8e0 call c6762c 635 c77571-c77576 630->635 636 c7757b-c7758c call c6c407 630->636 637 c77814-c7781b call ca0237 635->637 642 c7758e-c77593 636->642 643 c77598-c775a9 call c6c26e 636->643 644 c7781c-c77821 637->644 642->637 652 c775b5-c775ca call c6c4c8 643->652 653 c775ab-c775b0 643->653 646 c77823-c77824 call ca5636 644->646 647 c77829-c7782d 644->647 646->647 650 c77837-c7783c 647->650 651 c7782f-c77832 call ca5636 647->651 655 c77844-c77851 call c6c1bb 650->655 656 c7783e-c7783f call ca5636 650->656 651->650 662 c775d6-c775e6 call c8c001 652->662 663 c775cc-c775d1 652->663 653->637 664 c77853-c77856 call ca5636 655->664 665 c7785b-c7785f 655->665 656->655 671 c775f2-c77665 call c75c33 662->671 672 c775e8-c775ed 662->672 663->637 664->665 669 c77861-c77864 call ca5636 665->669 670 c77869-c7786d 665->670 669->670 674 c77877-c7787f 670->674 675 c7786f-c77872 call c63a16 670->675 679 c77667-c7766c 671->679 680 c77671-c77676 671->680 672->637 675->674 679->637 681 c7767d-c776b4 call c65602 GetCurrentProcess call ca0879 call c6827b 680->681 682 c77678 680->682 689 c776b6 681->689 690 c776ce-c776e5 call c6827b 681->690 682->681 691 c776bb-c776c9 call ca0237 689->691 696 c776e7-c776ec 690->696 697 c776ee-c776f3 690->697 691->644 696->691 698 c776f5-c77707 call c6821f 697->698 699 c7774f-c77754 697->699 710 c77713-c77723 call c63436 698->710 711 c77709-c7770e 698->711 700 c77756-c77768 call c6821f 699->700 701 c77774-c7777d 699->701 700->701 714 c7776a-c7776f 700->714 704 c7777f-c77782 701->704 705 c77789-c7779d call c7a50c 701->705 704->705 709 c77784-c77787 704->709 717 c777a6 705->717 718 c7779f-c777a4 705->718 709->705 715 c777ac-c777af 709->715 721 c77725-c7772a 710->721 722 c7772f-c77743 call c6821f 710->722 711->637 714->637 719 c777b6-c777cc call c6d5a0 715->719 720 c777b1-c777b4 715->720 717->715 718->637 727 c777d5-c777e4 call c6cbc5 719->727 728 c777ce-c777d3 719->728 720->644 720->719 721->637 722->699 729 c77745-c7774a 722->729 731 c777e9-c777ed 727->731 728->637 729->637 732 c777f6-c7780d call c6c8e6 731->732 733 c777ef-c777f4 731->733 732->644 736 c7780f 732->736 733->637 736->637
                                                            Strings
                                                            • Failed to extract bootstrapper application payloads., xrefs: 00C777EF
                                                            • Failed to load catalog files., xrefs: 00C7780F
                                                            • Failed to get unique temporary folder for bootstrapper application., xrefs: 00C777CE
                                                            • Failed to set original source variable., xrefs: 00C7776A
                                                            • WixBundleElevated, xrefs: 00C776A5, 00C776B6
                                                            • Failed to open manifest stream., xrefs: 00C775AB
                                                            • Failed to load manifest., xrefs: 00C775E8
                                                            • Failed to open attached UX container., xrefs: 00C7758E
                                                            • Failed to initialize variables., xrefs: 00C77571
                                                            • WixBundleSourceProcessPath, xrefs: 00C776F8
                                                            • WixBundleSourceProcessFolder, xrefs: 00C77734
                                                            • Failed to get manifest stream from container., xrefs: 00C775CC
                                                            • Failed to get source process folder from path., xrefs: 00C77725
                                                            • Failed to initialize internal cache functionality., xrefs: 00C7779F
                                                            • WixBundleOriginalSource, xrefs: 00C77759
                                                            • Failed to set source process path variable., xrefs: 00C77709
                                                            • Failed to overwrite the %ls built-in variable., xrefs: 00C776BB
                                                            • Failed to set source process folder variable., xrefs: 00C77745
                                                            • WixBundleUILevel, xrefs: 00C776D6, 00C776E7
                                                            • Failed to parse command line., xrefs: 00C77667
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalInitializeSection
                                                            • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
                                                            • API String ID: 32694325-1564579409
                                                            • Opcode ID: ac673019cf1d4285acec3b438cc5787b62d1b6fb3d54441e00a0e1df9dd10084
                                                            • Instruction ID: 6e752fd56cb72cbfece0df8c4357f70f4eb40112202f5f668e9dff34701133cd
                                                            • Opcode Fuzzy Hash: ac673019cf1d4285acec3b438cc5787b62d1b6fb3d54441e00a0e1df9dd10084
                                                            • Instruction Fuzzy Hash: 51A1A572A4461EBBCB269AA4CC85EEEB76CBB04740F048726F519F7141E730EA44D7A1
                                                            Function 00C6762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 842 c6762c-c67edf InitializeCriticalSection 843 c67ee2-c67f06 call c65623 842->843 846 c67f13-c67f24 call ca0237 843->846 847 c67f08-c67f0f 843->847 850 c67f27-c67f39 call c8e06f 846->850 847->843 848 c67f11 847->848 848->850
                                                            APIs
                                                            • InitializeCriticalSection.KERNEL32(00C7756B,00C653BD,00000000,00C65445), ref: 00C6764C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalInitializeSection
                                                            • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
                                                            • API String ID: 32694325-3635313340
                                                            • Opcode ID: 592b50186ad78836d69beab51695acabf2d20c037b706266564b867e6339033a
                                                            • Instruction ID: 6624c2de744869cc91b5b72365e7a1e331dd30d0cd344c45347e9e209a121dee
                                                            • Opcode Fuzzy Hash: 592b50186ad78836d69beab51695acabf2d20c037b706266564b867e6339033a
                                                            • Instruction Fuzzy Hash: 6E3237F0D1562A9FDF65CF5AC9887DDFAB4BB49308F5085EED20CA6210C7B40A898F45
                                                            Function 00C782BA Relevance: 33.4, APIs: 7, Strings: 12, Instructions: 153COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 854 c782ba-c78303 call c8f8e0 857 c7847c-c78489 call c62195 854->857 858 c78309-c78317 GetCurrentProcess call ca0879 854->858 865 c7848b 857->865 866 c78498-c784aa call c8e06f 857->866 861 c7831c-c78329 858->861 863 c783b7-c783c5 861->863 864 c7832f-c7833e GetWindowsDirectoryW 861->864 879 c783c7-c783d1 GetLastError 863->879 880 c783ff-c78411 UuidCreate 863->880 869 c78340-c7834a GetLastError 864->869 870 c78378-c78389 call c6337f 864->870 867 c78490-c78497 call ca0237 865->867 867->866 875 c78357 869->875 876 c7834c-c78355 869->876 883 c78395-c783ab call c636a3 870->883 884 c7838b-c78390 870->884 881 c7835e-c78373 call c63821 875->881 882 c78359 875->882 876->875 887 c783d3-c783dc 879->887 888 c783de 879->888 885 c78413-c78418 880->885 886 c7841a-c7842f StringFromGUID2 880->886 881->867 882->881 883->880 901 c783ad-c783b2 883->901 884->867 885->867 891 c78431-c7844b call c63821 886->891 892 c7844d-c7846e call c61f13 886->892 887->888 893 c783e5-c783fa call c63821 888->893 894 c783e0 888->894 891->867 904 c78477 892->904 905 c78470-c78475 892->905 893->867 894->893 901->867 904->857 905->867
                                                            APIs
                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00C65489), ref: 00C78310
                                                              • Part of subcall function 00CA0879: OpenProcessToken.ADVAPI32(?,00000008,?,00C653BD,00000000,?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA0897
                                                              • Part of subcall function 00CA0879: GetLastError.KERNEL32(?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA08A1
                                                              • Part of subcall function 00CA0879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA092B
                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00C78336
                                                            • GetLastError.KERNEL32 ref: 00C78340
                                                            • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00C783BD
                                                            • GetLastError.KERNEL32 ref: 00C783C7
                                                            • UuidCreate.RPCRT4(?), ref: 00C78406
                                                            Strings
                                                            • %ls%ls\, xrefs: 00C78458
                                                            • Failed to append bundle id on to temp path for working folder., xrefs: 00C78470
                                                            • Failed to create working folder guid., xrefs: 00C78413
                                                            • Failed to ensure windows path for working folder ended in backslash., xrefs: 00C7838B
                                                            • 4Mw, xrefs: 00C783BD
                                                            • cache.cpp, xrefs: 00C78364, 00C783EB, 00C7843C
                                                            • Failed to concat Temp directory on windows path for working folder., xrefs: 00C783AD
                                                            • Failed to get temp path for working folder., xrefs: 00C783F5
                                                            • Temp\, xrefs: 00C78395
                                                            • Failed to copy working folder path., xrefs: 00C7848B
                                                            • Failed to convert working folder guid into string., xrefs: 00C78446
                                                            • Failed to get windows path for working folder., xrefs: 00C7836E
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
                                                            • String ID: 4Mw$%ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                            • API String ID: 266130487-1835725942
                                                            • Opcode ID: 1ec3cb0435c487a83f175a2c677fda858447b8beddc391be6f0c1dfe5ffba820
                                                            • Instruction ID: 98818084ec9d348d8f891bf352e1d66c5ccc9acf47935875f8e76189fe58f4c4
                                                            • Opcode Fuzzy Hash: 1ec3cb0435c487a83f175a2c677fda858447b8beddc391be6f0c1dfe5ffba820
                                                            • Instruction Fuzzy Hash: 4C41C772E81325B7DB3096F4CC4EF9E7768AB04B15F108165BB08E7181EAB8DD0896E5
                                                            Function 00C810FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 906 c810fb-c81127 CoInitializeEx 907 c81129-c81136 call ca0237 906->907 908 c8113b-c81186 call c9f483 906->908 913 c8139e-c813b0 call c8e06f 907->913 914 c81188-c811ab call c63821 call ca0237 908->914 915 c811b0-c811d2 call c9f4a4 908->915 934 c81397-c81398 CoUninitialize 914->934 923 c811d8-c811e0 915->923 924 c8128c-c81297 SetEvent 915->924 928 c8138f-c81392 call c9f4b4 923->928 929 c811e6-c811ec 923->929 925 c81299-c812a3 GetLastError 924->925 926 c812d6-c812e4 WaitForSingleObject 924->926 932 c812b0 925->932 933 c812a5-c812ae 925->933 930 c81318-c81323 ResetEvent 926->930 931 c812e6-c812f0 GetLastError 926->931 928->934 929->928 936 c811f2-c811fa 929->936 939 c8135a-c81360 930->939 940 c81325-c8132f GetLastError 930->940 937 c812fd 931->937 938 c812f2-c812fb 931->938 941 c812b2 932->941 942 c812b4-c812c4 call c63821 932->942 933->932 934->913 943 c811fc-c811fe 936->943 944 c81274-c81287 call ca0237 936->944 950 c812ff 937->950 951 c81301-c81316 call c63821 937->951 938->937 947 c8138a 939->947 948 c81362-c81365 939->948 952 c8133c 940->952 953 c81331-c8133a 940->953 941->942 981 c812c9-c812d1 call ca0237 942->981 945 c81200 943->945 946 c81211-c81214 943->946 944->928 955 c81202-c81204 945->955 956 c81206-c8120f 945->956 959 c8126e 946->959 960 c81216 946->960 947->928 957 c81386-c81388 948->957 958 c81367-c81381 call c63821 948->958 950->951 951->981 963 c8133e 952->963 964 c81340-c81355 call c63821 952->964 953->952 966 c81270-c81272 955->966 956->966 957->928 958->981 959->966 968 c81239-c8123e 960->968 969 c8126a-c8126c 960->969 970 c8122b-c81230 960->970 971 c8125c-c81261 960->971 972 c8121d-c81222 960->972 973 c8124e-c81253 960->973 974 c81240-c81245 960->974 975 c81232-c81237 960->975 976 c81263-c81268 960->976 977 c81224-c81229 960->977 978 c81255-c8125a 960->978 979 c81247-c8124c 960->979 963->964 964->981 966->924 966->944 968->944 969->944 970->944 971->944 972->944 973->944 974->944 975->944 976->944 977->944 978->944 979->944 981->928
                                                            APIs
                                                            • CoInitializeEx.OLE32(00000000,00000000), ref: 00C8111D
                                                            • CoUninitialize.COMBASE ref: 00C81398
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: InitializeUninitialize
                                                            • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 3442037557-1168358783
                                                            • Opcode ID: 8199f2b89f7fad08b78cb502a39e945520de4e715b354c4d9c2a390493a5bdfe
                                                            • Instruction ID: 381a3c4870e41fd9309da9dd02fa53e1a8d568bca1e464527705d5ceabc537bc
                                                            • Opcode Fuzzy Hash: 8199f2b89f7fad08b78cb502a39e945520de4e715b354c4d9c2a390493a5bdfe
                                                            • Instruction Fuzzy Hash: E6513936940271E78B2077D58C05FBF369C9B46768B2A0335FC11FB2A1D6158D0293DE
                                                            Function 00C642D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 987 c642d7-c6432e InitializeCriticalSection * 2 call c74d05 * 2 992 c64334 987->992 993 c64452-c6445c call c6b48b 987->993 994 c6433a-c64347 992->994 998 c64461-c64465 993->998 996 c64445-c6444c 994->996 997 c6434d-c64379 lstrlenW * 2 CompareStringW 994->997 996->993 996->994 999 c643cb-c643f7 lstrlenW * 2 CompareStringW 997->999 1000 c6437b-c6439e lstrlenW 997->1000 1001 c64467-c64473 call ca0237 998->1001 1002 c64474-c6447c 998->1002 999->996 1006 c643f9-c6441c lstrlenW 999->1006 1003 c643a4-c643a9 1000->1003 1004 c6448a-c6449f call c63821 1000->1004 1001->1002 1003->1004 1007 c643af-c643bf call c629ce 1003->1007 1018 c644a4-c644ab 1004->1018 1010 c644b6-c644d0 call c63821 1006->1010 1011 c64422-c64427 1006->1011 1021 c643c5 1007->1021 1022 c6447f-c64488 1007->1022 1010->1018 1011->1010 1015 c6442d-c6443d call c629ce 1011->1015 1015->1022 1025 c6443f 1015->1025 1023 c644ac-c644b4 call ca0237 1018->1023 1021->999 1022->1023 1023->1002 1025->996
                                                            APIs
                                                            • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00C65266,?,?,00000000,?,?), ref: 00C64303
                                                            • InitializeCriticalSection.KERNEL32(000000D0,?,?,00C65266,?,?,00000000,?,?), ref: 00C6430C
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00C65266,?,?,00000000,?,?), ref: 00C64352
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00C65266,?,?,00000000,?,?), ref: 00C6435C
                                                            • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00C65266,?,?,00000000,?,?), ref: 00C64370
                                                            • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00C65266,?,?,00000000,?,?), ref: 00C64380
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00C65266,?,?,00000000,?,?), ref: 00C643D0
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00C65266,?,?,00000000,?,?), ref: 00C643DA
                                                            • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00C65266,?,?,00000000,?,?), ref: 00C643EE
                                                            • lstrlenW.KERNEL32(burn.filehandle.self,?,?,00C65266,?,?,00000000,?,?), ref: 00C643FE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                            • String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                            • API String ID: 3039292287-3209860532
                                                            • Opcode ID: e366aa1a54c59fe0facec37f36d7961b08cb5bb8d09038ed83df09e6bb16b453
                                                            • Instruction ID: b5f63a1290cd6caaf80b3a06f2ece708920a237910ebc082d7c3440365797ffa
                                                            • Opcode Fuzzy Hash: e366aa1a54c59fe0facec37f36d7961b08cb5bb8d09038ed83df09e6bb16b453
                                                            • Instruction Fuzzy Hash: 4F51A171A40216BFCB38DB68DC86FAA776CEF05764F100126F614E7291DB74AD50CAA4
                                                            Function 00C7E7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1027 c7e7b4-c7e7f1 1028 c7e813-c7e834 RegisterClassW 1027->1028 1029 c7e7f3-c7e807 TlsSetValue 1027->1029 1031 c7e836-c7e840 GetLastError 1028->1031 1032 c7e86e-c7e8a5 CreateWindowExW 1028->1032 1029->1028 1030 c7e809-c7e80e 1029->1030 1035 c7e93d-c7e953 UnregisterClassW 1030->1035 1036 c7e842-c7e84b 1031->1036 1037 c7e84d 1031->1037 1033 c7e8a7-c7e8b1 GetLastError 1032->1033 1034 c7e8dc-c7e8f0 SetEvent 1032->1034 1038 c7e8b3-c7e8bc 1033->1038 1039 c7e8be 1033->1039 1040 c7e91c-c7e927 GetMessageW 1034->1040 1036->1037 1041 c7e854-c7e869 call c63821 1037->1041 1042 c7e84f 1037->1042 1038->1039 1043 c7e8c5-c7e8da call c63821 1039->1043 1044 c7e8c0 1039->1044 1045 c7e8f2-c7e8f5 1040->1045 1046 c7e929 1040->1046 1054 c7e935-c7e93c call ca0237 1041->1054 1042->1041 1043->1054 1044->1043 1049 c7e8f7-c7e906 IsDialogMessageW 1045->1049 1050 c7e92b-c7e930 1045->1050 1046->1035 1049->1040 1053 c7e908-c7e916 TranslateMessage DispatchMessageW 1049->1053 1050->1054 1053->1040 1054->1035
                                                            APIs
                                                            • TlsSetValue.KERNEL32(?,?), ref: 00C7E7FF
                                                            • RegisterClassW.USER32(?), ref: 00C7E82B
                                                            • GetLastError.KERNEL32 ref: 00C7E836
                                                            • CreateWindowExW.USER32(00000080,00CB9E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00C7E89D
                                                            • GetLastError.KERNEL32 ref: 00C7E8A7
                                                            • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00C7E945
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                            • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                            • API String ID: 213125376-288575659
                                                            • Opcode ID: 5b456a596266c42923232289b353e485b7c06fe33e266c4fdaebb72dc4281af8
                                                            • Instruction ID: 045743bdc568d85bd17ff12399cb738d744d0349fec1acb396fd28ce89499d8a
                                                            • Opcode Fuzzy Hash: 5b456a596266c42923232289b353e485b7c06fe33e266c4fdaebb72dc4281af8
                                                            • Instruction Fuzzy Hash: 5C419373901215ABDF208BA5DC49BDEBFB8EF09750F108165FA19A7191DB319D40CBA1
                                                            Function 00C6C28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1057 c6c28f-c6c2c1 1058 c6c2c3-c6c2e1 CreateFileW 1057->1058 1059 c6c32b-c6c347 GetCurrentProcess * 2 DuplicateHandle 1057->1059 1062 c6c2e7-c6c2f1 GetLastError 1058->1062 1063 c6c383-c6c389 1058->1063 1060 c6c381 1059->1060 1061 c6c349-c6c353 GetLastError 1059->1061 1060->1063 1066 c6c355-c6c35e 1061->1066 1067 c6c360 1061->1067 1068 c6c2f3-c6c2fc 1062->1068 1069 c6c2fe 1062->1069 1064 c6c393 1063->1064 1065 c6c38b-c6c391 1063->1065 1070 c6c395-c6c3a3 SetFilePointerEx 1064->1070 1065->1070 1066->1067 1071 c6c367-c6c37f call c63821 1067->1071 1072 c6c362 1067->1072 1068->1069 1073 c6c305-c6c318 call c63821 1069->1073 1074 c6c300 1069->1074 1076 c6c3a5-c6c3af GetLastError 1070->1076 1077 c6c3da-c6c3e0 1070->1077 1085 c6c31d-c6c326 call ca0237 1071->1085 1072->1071 1073->1085 1074->1073 1080 c6c3b1-c6c3ba 1076->1080 1081 c6c3bc 1076->1081 1082 c6c3e2-c6c3e6 call c81741 1077->1082 1083 c6c3fe-c6c404 1077->1083 1080->1081 1086 c6c3c3-c6c3d8 call c63821 1081->1086 1087 c6c3be 1081->1087 1091 c6c3eb-c6c3ef 1082->1091 1085->1083 1095 c6c3f6-c6c3fd call ca0237 1086->1095 1087->1086 1091->1083 1094 c6c3f1 1091->1094 1094->1095 1095->1083
                                                            APIs
                                                            • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00C6C47F,00C65405,?,?,00C65445), ref: 00C6C2D6
                                                            • GetLastError.KERNEL32(?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C2E7
                                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?), ref: 00C6C336
                                                            • GetCurrentProcess.KERNEL32(000000FF,00000000,?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C33C
                                                            • DuplicateHandle.KERNELBASE(00000000,?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C33F
                                                            • GetLastError.KERNEL32(?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C349
                                                            • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C39B
                                                            • GetLastError.KERNEL32(?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C6C3A5
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                            • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                            • API String ID: 2619879409-373955632
                                                            • Opcode ID: 1707243dba71e9551c14cdf204f4afe1722eec2c3cd498ede2bf967b83b8ac0e
                                                            • Instruction ID: d2373ed362998c466d9872d5e4e17b939aa5c885e97b2b2cb30450fdd9676da8
                                                            • Opcode Fuzzy Hash: 1707243dba71e9551c14cdf204f4afe1722eec2c3cd498ede2bf967b83b8ac0e
                                                            • Instruction Fuzzy Hash: F341C876540201ABD7309E698DC9F6B3BA5EB86724B218139FD649B392D771CC01DBA0
                                                            Function 00CA2AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1098 ca2af7-ca2b17 call c63838 1101 ca2b1d-ca2b2b call ca4a6c 1098->1101 1102 ca2c21-ca2c25 1098->1102 1106 ca2b30-ca2b4f GetProcAddress 1101->1106 1104 ca2c2f-ca2c35 1102->1104 1105 ca2c27-ca2c2a call ca5636 1102->1105 1105->1104 1108 ca2b51 1106->1108 1109 ca2b56-ca2b6f GetProcAddress 1106->1109 1108->1109 1110 ca2b71 1109->1110 1111 ca2b76-ca2b8f GetProcAddress 1109->1111 1110->1111 1112 ca2b91 1111->1112 1113 ca2b96-ca2baf GetProcAddress 1111->1113 1112->1113 1114 ca2bb1 1113->1114 1115 ca2bb6-ca2bcf GetProcAddress 1113->1115 1114->1115 1116 ca2bd1 1115->1116 1117 ca2bd6-ca2bef GetProcAddress 1115->1117 1116->1117 1118 ca2bf1 1117->1118 1119 ca2bf6-ca2c10 GetProcAddress 1117->1119 1118->1119 1120 ca2c12 1119->1120 1121 ca2c17 1119->1121 1120->1121 1121->1102
                                                            APIs
                                                              • Part of subcall function 00C63838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00C63877
                                                              • Part of subcall function 00C63838: GetLastError.KERNEL32 ref: 00C63881
                                                              • Part of subcall function 00CA4A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00CA4A9D
                                                            • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00CA2B41
                                                            • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00CA2B61
                                                            • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00CA2B81
                                                            • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00CA2BA1
                                                            • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00CA2BC1
                                                            • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00CA2BE1
                                                            • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00CA2C01
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$ErrorLast$DirectorySystem
                                                            • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                            • API String ID: 2510051996-1735120554
                                                            • Opcode ID: 7affdd2073ebc76f1c2e120f3f3a169cc8fadcc7d9e788554eccd1a1dac59edf
                                                            • Instruction ID: 0adb926cd5d442d07ea7a37aa77ea171bce703f388ffc6cd6ec09d549288af01
                                                            • Opcode Fuzzy Hash: 7affdd2073ebc76f1c2e120f3f3a169cc8fadcc7d9e788554eccd1a1dac59edf
                                                            • Instruction Fuzzy Hash: 1D31DFB0941219EBEB199FA4EE03F6E7BB8F715709F00013AF45466270E7B20D45AF54
                                                            Function 00CA304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1122 ca304f-ca3073 GetModuleHandleA 1123 ca30a8-ca30b9 GetProcAddress 1122->1123 1124 ca3075-ca307f GetLastError 1122->1124 1127 ca30bb-ca30df GetProcAddress * 3 1123->1127 1128 ca30fc 1123->1128 1125 ca308c 1124->1125 1126 ca3081-ca308a 1124->1126 1130 ca308e 1125->1130 1131 ca3093-ca30a3 call c63821 1125->1131 1126->1125 1132 ca30f8-ca30fa 1127->1132 1133 ca30e1-ca30e3 1127->1133 1129 ca30fe-ca311b CoCreateInstance 1128->1129 1134 ca31b1-ca31b3 1129->1134 1135 ca3121-ca3123 1129->1135 1130->1131 1145 ca31c7-ca31cc 1131->1145 1132->1129 1133->1132 1137 ca30e5-ca30e7 1133->1137 1139 ca31c6 1134->1139 1140 ca31b5-ca31bc 1134->1140 1138 ca3128-ca3138 1135->1138 1137->1132 1142 ca30e9-ca30f6 1137->1142 1143 ca313a-ca313e 1138->1143 1144 ca3142 1138->1144 1139->1145 1140->1139 1155 ca31be-ca31c0 ExitProcess 1140->1155 1142->1129 1143->1138 1147 ca3140 1143->1147 1149 ca3144-ca3154 1144->1149 1150 ca31ce-ca31d0 1145->1150 1151 ca31d4-ca31d9 1145->1151 1154 ca315c 1147->1154 1156 ca3166-ca316a 1149->1156 1157 ca3156-ca315a 1149->1157 1150->1151 1152 ca31db-ca31dd 1151->1152 1153 ca31e1-ca31e8 1151->1153 1152->1153 1154->1156 1158 ca316c-ca317f call ca31eb 1156->1158 1159 ca3195-ca31a6 1156->1159 1157->1149 1157->1154 1158->1134 1164 ca3181-ca3193 1158->1164 1159->1134 1162 ca31a8-ca31af 1159->1162 1162->1134 1164->1134 1164->1159
                                                            APIs
                                                            • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00CA3609,00000000,?,00000000), ref: 00CA3069
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00C8C025,?,00C65405,?,00000000,?), ref: 00CA3075
                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00CA30B5
                                                            • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00CA30C1
                                                            • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00CA30CC
                                                            • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00CA30D6
                                                            • CoCreateInstance.OLE32(00CCB6B8,00000000,00000001,00CAB818,?,?,?,?,?,?,?,?,?,?,?,00C8C025), ref: 00CA3111
                                                            • ExitProcess.KERNEL32 ref: 00CA31C0
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                            • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                            • API String ID: 2124981135-499589564
                                                            • Opcode ID: 2dc2709cab91c853d49507807e774e5bd139e8c1909794ff0ea876c14e94ba40
                                                            • Instruction ID: a722fefa714707b15b92bef64180daef4051499ab6b077a4aa476e85987deecf
                                                            • Opcode Fuzzy Hash: 2dc2709cab91c853d49507807e774e5bd139e8c1909794ff0ea876c14e94ba40
                                                            • Instruction Fuzzy Hash: CC41E331B00256ABCB249FA8CC65FAEB7B4EF46718F110068FA11E7241CB71DF408B90
                                                            Function 00C81741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1166 c81741-c81761 call c62195 1169 c8176d-c8177f CreateEventW 1166->1169 1170 c81763-c81768 1166->1170 1172 c817b9-c817c5 CreateEventW 1169->1172 1173 c81781-c8178b GetLastError 1169->1173 1171 c81859-c81860 call ca0237 1170->1171 1192 c81861-c81867 1171->1192 1176 c817fc-c81811 CreateThread 1172->1176 1177 c817c7-c817d1 GetLastError 1172->1177 1174 c81798 1173->1174 1175 c8178d-c81796 1173->1175 1179 c8179a 1174->1179 1180 c8179f-c817b4 call c63821 1174->1180 1175->1174 1184 c81848-c81852 call c814e1 1176->1184 1185 c81813-c8181d GetLastError 1176->1185 1181 c817de 1177->1181 1182 c817d3-c817dc 1177->1182 1179->1180 1180->1171 1190 c817e0 1181->1190 1191 c817e5-c817fa call c63821 1181->1191 1182->1181 1184->1192 1199 c81854 1184->1199 1186 c8182a 1185->1186 1187 c8181f-c81828 1185->1187 1193 c8182c 1186->1193 1194 c81831-c81846 call c63821 1186->1194 1187->1186 1190->1191 1191->1171 1193->1194 1194->1171 1199->1171
                                                            APIs
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00C6C3EB,?,00000000,?,00C6C47F), ref: 00C81778
                                                            • GetLastError.KERNEL32(?,00C6C3EB,?,00000000,?,00C6C47F,00C65405,?,?,00C65445,00C65445,00000000,?,00000000), ref: 00C81781
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateErrorEventLast
                                                            • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                            • API String ID: 545576003-938279966
                                                            • Opcode ID: 1214058c74ef71bff15147e8bdfd1cc015f1a0460aff86e37379fc8d3dfb2b5a
                                                            • Instruction ID: 9d1aff9b48f78297472b5e7391c90ec7054e1155ec0d5594cca943a1830e080f
                                                            • Opcode Fuzzy Hash: 1214058c74ef71bff15147e8bdfd1cc015f1a0460aff86e37379fc8d3dfb2b5a
                                                            • Instruction Fuzzy Hash: CD2108B7D4063676D33136A54C46F6B6ADCEB04BA8F064226FD50BB1C1E750DC0197E9
                                                            Function 00C9FCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00C9FCD6
                                                            • GetProcAddress.KERNEL32(SystemFunction041), ref: 00C9FCE8
                                                            • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00C9FD2B
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00C9FD3F
                                                            • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00C9FD77
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00C9FD8B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$ErrorLast
                                                            • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                            • API String ID: 4214558900-3191127217
                                                            • Opcode ID: 9959004032e9a08d956d016ceeabd7fe207093b8d8000c54ce919c32ff31ba26
                                                            • Instruction ID: 5c62df1ab82bb85ff02169d259692e8515dfcf7e75ccfb5f337044c76c9cc22d
                                                            • Opcode Fuzzy Hash: 9959004032e9a08d956d016ceeabd7fe207093b8d8000c54ce919c32ff31ba26
                                                            • Instruction Fuzzy Hash: 7A219F339452729BCB319FA6EE0EF4E6990AB40B55F06013DFC10EB2A1E764CD429AD0
                                                            Function 00C808C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00C808F2
                                                            • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00C8090A
                                                            • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00C8090F
                                                            • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00C80912
                                                            • GetLastError.KERNEL32(?,?), ref: 00C8091C
                                                            • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00C8098B
                                                            • GetLastError.KERNEL32(?,?), ref: 00C80998
                                                            Strings
                                                            • Failed to open cabinet file: %hs, xrefs: 00C809C9
                                                            • Failed to add virtual file pointer for cab container., xrefs: 00C80971
                                                            • <the>.cab, xrefs: 00C808EB
                                                            • Failed to duplicate handle to cab container., xrefs: 00C8094A
                                                            • cabextract.cpp, xrefs: 00C80940, 00C809BC
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                            • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                            • API String ID: 3030546534-3446344238
                                                            • Opcode ID: 647f063f2e0e8ca78b083b8c66e2b2d0f6ac249546de4bfaa760e583a879fc9e
                                                            • Instruction ID: a006f55b8f82a05c32fcd4e822db8e4d2b3e3ee8cda2f86f941741ae5bb0d202
                                                            • Opcode Fuzzy Hash: 647f063f2e0e8ca78b083b8c66e2b2d0f6ac249546de4bfaa760e583a879fc9e
                                                            • Instruction Fuzzy Hash: 9A315732E41236BBEB206B958C49F9FBE68EF05769F210225FE04B7241D7209D00DBE4
                                                            Function 00C73F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00C73AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00C73FB5,feclient.dll,?,00000000,?,?,?,00C64B12), ref: 00C73B42
                                                            • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00C64B12,?,?,00CAB488,?,00000001,00000000,00000000), ref: 00C7404C
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseSleep
                                                            • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                            • API String ID: 2834455192-2673269691
                                                            • Opcode ID: 132afd9fe64b9911a0d2babf72a4746f038f21d124e6ff802bcfe5b472892d59
                                                            • Instruction ID: 7588663690cbf4b8cc7ca1f9f0f3a49f38d91be649a9219c80f20b83549cdd8b
                                                            • Opcode Fuzzy Hash: 132afd9fe64b9911a0d2babf72a4746f038f21d124e6ff802bcfe5b472892d59
                                                            • Instruction Fuzzy Hash: 2661D471A00616ABDF29AF64CC86B7A77A8EF11380F14C165FD18DB150E770EE90A790
                                                            Function 00C66DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00000001,?,00000000,00C65445,00000006,?,00C682B9,?,?,?,00000000,00000000,00000001), ref: 00C66DC8
                                                              • Part of subcall function 00C656A9: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00C66595,00C66595,?,00C6563D,?,?,00000000), ref: 00C656E5
                                                              • Part of subcall function 00C656A9: GetLastError.KERNEL32(?,00C6563D,?,?,00000000,?,?,00C66595,?,00C67F02,?,?,?,?,?), ref: 00C65714
                                                            • LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,00C682B9), ref: 00C66F59
                                                            Strings
                                                            • Attempt to set built-in variable value: %ls, xrefs: 00C66E56
                                                            • variable.cpp, xrefs: 00C66E4B
                                                            • Failed to set value of variable: %ls, xrefs: 00C66F41
                                                            • Setting hidden variable '%ls', xrefs: 00C66E86
                                                            • Setting string variable '%ls' to value '%ls', xrefs: 00C66EED
                                                            • Setting numeric variable '%ls' to value %lld, xrefs: 00C66EFA
                                                            • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00C66F6B
                                                            • Failed to find variable value '%ls'., xrefs: 00C66DE3
                                                            • Unsetting variable '%ls', xrefs: 00C66F15
                                                            • Failed to insert variable '%ls'., xrefs: 00C66E0D
                                                            • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00C66ED0
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                            • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                            • API String ID: 2716280545-445000439
                                                            • Opcode ID: a0bccb61959f8c647a58f15ae4637f8c128f549f7c0bed386eb9117d1cfb4241
                                                            • Instruction ID: ed01c52917d454b5788fa928751f808aa65d218dcb6bf66990fc0732abed04e5
                                                            • Opcode Fuzzy Hash: a0bccb61959f8c647a58f15ae4637f8c128f549f7c0bed386eb9117d1cfb4241
                                                            • Instruction Fuzzy Hash: 11512C71A40216B7CB309F55DCCAF6B7BA8EF56718F200129F81596282C271DD41CBE2
                                                            Function 00C64AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • IsWindow.USER32(?), ref: 00C64C64
                                                            • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C64C75
                                                            Strings
                                                            • Failed to check global conditions, xrefs: 00C64B49
                                                            • Failed to set action variables., xrefs: 00C64BC4
                                                            • Failed while running , xrefs: 00C64C2A
                                                            • Failed to set layout directory variable to value provided from command-line., xrefs: 00C64C06
                                                            • Failed to create the message window., xrefs: 00C64B98
                                                            • Failed to open log., xrefs: 00C64B18
                                                            • Failed to query registration., xrefs: 00C64BAE
                                                            • Failed to set registration variables., xrefs: 00C64BDE
                                                            • WixBundleLayoutDirectory, xrefs: 00C64BF5
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: MessagePostWindow
                                                            • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                            • API String ID: 3618638489-3051724725
                                                            • Opcode ID: a0f871e5c8d87bbd9301579ee6da2406361d7630f1c00350b6601f1b14d18e17
                                                            • Instruction ID: 1e045fb9239396096f7cf82bb00a9c9dae6414db96a0a24be513d4a60a0668f6
                                                            • Opcode Fuzzy Hash: a0f871e5c8d87bbd9301579ee6da2406361d7630f1c00350b6601f1b14d18e17
                                                            • Instruction Fuzzy Hash: 5741D131A05A1BBFCB3E5A20CCC5FABBA6DFF05754F004225F814A6251EBA1ED50A7D0
                                                            Function 00C62DBF Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 203sleepfiletimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00C62E5F
                                                            • GetLastError.KERNEL32 ref: 00C62E69
                                                            • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00C62F09
                                                            • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00C62F96
                                                            • GetLastError.KERNEL32 ref: 00C62FA3
                                                            • Sleep.KERNEL32(00000064), ref: 00C62FB7
                                                            • CloseHandle.KERNEL32(?), ref: 00C6301F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                            • String ID: 4Mw$%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                            • API String ID: 3480017824-721117420
                                                            • Opcode ID: e380e820217315fdd36f162a7ef7ccbe7b64594e586e98240a6f74d99691844b
                                                            • Instruction ID: f11df090dc30d9ee7fe9eafb8b8f456b806bb68ce06a44d49f1d03a0e038af82
                                                            • Opcode Fuzzy Hash: e380e820217315fdd36f162a7ef7ccbe7b64594e586e98240a6f74d99691844b
                                                            • Instruction Fuzzy Hash: 6E717572D01539ABDB309FA4DC89BAEB7B8AB08715F0041A5FA14E7191D7349F819F60
                                                            Function 00C7EA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00C6548E,?,?), ref: 00C7EA9D
                                                            • GetLastError.KERNEL32(?,00C6548E,?,?), ref: 00C7EAAA
                                                            • CreateThread.KERNELBASE(00000000,00000000,Function_0001E7B4,?,00000000,00000000), ref: 00C7EB03
                                                            • GetLastError.KERNEL32(?,00C6548E,?,?), ref: 00C7EB10
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00C6548E,?,?), ref: 00C7EB4B
                                                            • CloseHandle.KERNEL32(00000000,?,00C6548E,?,?), ref: 00C7EB6A
                                                            • CloseHandle.KERNELBASE(?,?,00C6548E,?,?), ref: 00C7EB77
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                            • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                            • API String ID: 2351989216-3599963359
                                                            • Opcode ID: 1eb2514188d1f73a4f632d7fc184ad6509c3e405209627ae71d13371e86aa88d
                                                            • Instruction ID: 756a44727e2bfa99b50dabee4cbc2d535eec68e34e520283d38ffa460eb22dbe
                                                            • Opcode Fuzzy Hash: 1eb2514188d1f73a4f632d7fc184ad6509c3e405209627ae71d13371e86aa88d
                                                            • Instruction Fuzzy Hash: F3319477D01229BBDB10DFA98D85B9FBBBCFF08750F114166B919F7241E6309E0096A1
                                                            Function 00C814E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,774D2F60,?,?,00C65405,00C653BD,00000000,00C65445), ref: 00C81506
                                                            • GetLastError.KERNEL32 ref: 00C81519
                                                            • GetExitCodeThread.KERNELBASE(00CAB488,?), ref: 00C8155B
                                                            • GetLastError.KERNEL32 ref: 00C81569
                                                            • ResetEvent.KERNEL32(00CAB460), ref: 00C815A4
                                                            • GetLastError.KERNEL32 ref: 00C815AE
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                            • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                            • API String ID: 2979751695-3400260300
                                                            • Opcode ID: 2d990ed7a6575006f968265c62e42b3f00404ba428c8fe0141fee9feb8502872
                                                            • Instruction ID: 7ed085ee4ebe765a494dcea6439aca6b649526e91b88b0caab187b2302073925
                                                            • Opcode Fuzzy Hash: 2d990ed7a6575006f968265c62e42b3f00404ba428c8fe0141fee9feb8502872
                                                            • Instruction Fuzzy Hash: 0C31B4B0A00205ABDB10AFA68D45BAE7BFCEB44704F10416AFD56D7161E731CA01AB69
                                                            Function 00C6CBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,00C653BD,00000000,00C65489,00C65445,WixBundleUILevel,840F01E8,?,00000001), ref: 00C6CC1C
                                                            Strings
                                                            • Failed to ensure directory exists, xrefs: 00C6CCEE
                                                            • Failed to find embedded payload: %ls, xrefs: 00C6CC48
                                                            • Failed to extract file., xrefs: 00C6CCE7
                                                            • Failed to concat file paths., xrefs: 00C6CCFC
                                                            • Payload was not found in container: %ls, xrefs: 00C6CD29
                                                            • Failed to get directory portion of local file path, xrefs: 00C6CCF5
                                                            • payload.cpp, xrefs: 00C6CD1D
                                                            • Failed to get next stream., xrefs: 00C6CD03
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareString
                                                            • String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                            • API String ID: 1825529933-1711239286
                                                            • Opcode ID: e61fead9ab4b16b6bf2f905ff3c089403b1fd0d321dc101e8de73dde084a38d3
                                                            • Instruction ID: 852b2edd57537fd76d84f18c3f7e8767e4516ea9e3f0bb950c8180915f5662cf
                                                            • Opcode Fuzzy Hash: e61fead9ab4b16b6bf2f905ff3c089403b1fd0d321dc101e8de73dde084a38d3
                                                            • Instruction Fuzzy Hash: F241D231A40219FBCF359F89CCC59BEBBB5BF01710B10817AE9A5AB251D7709E41EB90
                                                            Function 00C64796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00C647BB
                                                            • GetCurrentThreadId.KERNEL32 ref: 00C647C1
                                                            • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C6484F
                                                            Strings
                                                            • Failed to load UX., xrefs: 00C64804
                                                            • Failed to start bootstrapper application., xrefs: 00C6481D
                                                            • engine.cpp, xrefs: 00C6489B
                                                            • Failed to create engine for UX., xrefs: 00C647DB
                                                            • Unexpected return value from message pump., xrefs: 00C648A5
                                                            • wininet.dll, xrefs: 00C647EE
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Message$CurrentPeekThread
                                                            • String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
                                                            • API String ID: 673430819-2573580774
                                                            • Opcode ID: f638aa125bf021de45856733ca43518d7fa0da959a84b4e8ad139dc719391058
                                                            • Instruction ID: 074142aa1e59409016d0b70981e8d3a16a1930aa174e74cbfed1b8ba45538886
                                                            • Opcode Fuzzy Hash: f638aa125bf021de45856733ca43518d7fa0da959a84b4e8ad139dc719391058
                                                            • Instruction Fuzzy Hash: 8841B671A00655BFDB289BA4CCC5EBE77ACEF09318F100125F915E7291DB30ED4597A0
                                                            Function 00C6D6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00C647FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00C6548E,?), ref: 00C6D6DA
                                                            • GetLastError.KERNEL32(?,00C647FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00C6548E,?,?), ref: 00C6D6E7
                                                            • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00C6D71F
                                                            • GetLastError.KERNEL32(?,00C647FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00C6548E,?,?), ref: 00C6D72B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$AddressLibraryLoadProc
                                                            • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
                                                            • API String ID: 1866314245-2276003667
                                                            • Opcode ID: 895cde9e76549e11748fef6987e5185e68e3e9350a09da14bb5937ec680c3bbb
                                                            • Instruction ID: 5b8fdedc88fbbffabc68e0f40721ac9ce105ca1c684e0ec09b9779c2dfc59646
                                                            • Opcode Fuzzy Hash: 895cde9e76549e11748fef6987e5185e68e3e9350a09da14bb5937ec680c3bbb
                                                            • Instruction Fuzzy Hash: F1110477F80B32ABC73116D59C49B5B6A94AF06B65F010539FE12EB281DB20DC0086D1
                                                            Function 00CA9AA6 Relevance: 15.1, APIs: 10, Instructions: 124libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryExA.KERNELBASE ref: 00CA9AA6
                                                            • GetLastError.KERNEL32 ref: 00CA9AB2
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CA9AE1
                                                            • RaiseException.KERNEL32(C06D007E,?,00000001,?), ref: 00CA9AF2
                                                            • FreeLibrary.KERNEL32(00000000), ref: 00CA9B0C
                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00CA9B74
                                                            • GetLastError.KERNEL32 ref: 00CA9B80
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CA9BAF
                                                            • RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 00CA9BC0
                                                            • DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CA9BF7
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AccessDloadReleaseSectionWrite$ErrorExceptionLastLibraryRaise$AddressFreeLoadProc
                                                            • String ID:
                                                            • API String ID: 202095176-0
                                                            • Opcode ID: 6a6c36b2d0bf4e2b8ba96ee3eba40980ac9b66848f404087f5261c21ff8ee546
                                                            • Instruction ID: 3c43f21a83abfe84c7c100b4cb69cbbe367e719630637f6a9d1f73b4ae8af500
                                                            • Opcode Fuzzy Hash: 6a6c36b2d0bf4e2b8ba96ee3eba40980ac9b66848f404087f5261c21ff8ee546
                                                            • Instruction Fuzzy Hash: FE41603590161AAFCB21DFA4E895BAEB7B4FF49314F01416AF911A7361DB709E00CBA0
                                                            Function 00C6F812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00C6F942
                                                            • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00C6F94F
                                                            Strings
                                                            • Failed to read Resume value., xrefs: 00C6F8D8
                                                            • Resume, xrefs: 00C6F8B6
                                                            • Failed to format pending restart registry key to read., xrefs: 00C6F846
                                                            • Failed to open registration key., xrefs: 00C6F8AB
                                                            • %ls.RebootRequired, xrefs: 00C6F82F
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Close
                                                            • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                            • API String ID: 3535843008-3890505273
                                                            • Opcode ID: 31782979ec0449ff5191b2ba2659895e03a50b8d2541313fdb46839a2f1e8323
                                                            • Instruction ID: 0544f7be9e90e748b31a03968cc982f6e6729a46da8dfe46b587123f27f2b807
                                                            • Opcode Fuzzy Hash: 31782979ec0449ff5191b2ba2659895e03a50b8d2541313fdb46839a2f1e8323
                                                            • Instruction Fuzzy Hash: BD415F72900159FFCB219F99D8C1BADBBB4FF05310F59417AE910AB250C3729E42DB50
                                                            Function 6E860948 Relevance: 12.1, APIs: 8, Instructions: 136COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • __RTC_Initialize.LIBCMT ref: 6E86098F
                                                            • ___scrt_uninitialize_crt.LIBCMT ref: 6E8609A9
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Initialize___scrt_uninitialize_crt
                                                            • String ID:
                                                            • API String ID: 2442719207-0
                                                            • Opcode ID: c90b948dd75b3c779ae7dcf39eb4ae46f12f745977de97871dcb9f56f07c85cf
                                                            • Instruction ID: d67880681c006672252463a505fbf8982c6e60c284449765c25b5ede9e4a2875
                                                            • Opcode Fuzzy Hash: c90b948dd75b3c779ae7dcf39eb4ae46f12f745977de97871dcb9f56f07c85cf
                                                            • Instruction Fuzzy Hash: 3C41C272D44619EFDB308FD9C840BAE3779EB81799F004D15E8186A2D0E7714901CB98
                                                            Function 00CA0523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(00CCB5FC,00000000,?,?,?,00C74207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00C654FA,?), ref: 00CA0533
                                                            • CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00CCB5F4,?,00C74207,00000000,Setup), ref: 00CA05D7
                                                            • GetLastError.KERNEL32(?,00C74207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00C654FA,?,?,?), ref: 00CA05E7
                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00C74207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00C654FA,?), ref: 00CA0621
                                                              • Part of subcall function 00C62DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00C62F09
                                                            • LeaveCriticalSection.KERNEL32(00CCB5FC,?,?,00CCB5F4,?,00C74207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00C654FA,?), ref: 00CA067A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                            • String ID: logutil.cpp
                                                            • API String ID: 4111229724-3545173039
                                                            • Opcode ID: 28e9f95d61ad9041b87acd5e8d9c9b8f099996728b866044ca1dfb85ee414136
                                                            • Instruction ID: 2ba83ca5f8d77e177825dabe5d9ea724ef8c57fc5e84ed51eb7fb4fdc9ceefc3
                                                            • Opcode Fuzzy Hash: 28e9f95d61ad9041b87acd5e8d9c9b8f099996728b866044ca1dfb85ee414136
                                                            • Instruction Fuzzy Hash: F831B371D0062BEBDB219FA1CD8AFAE7768AB0279DF100125FD10A7161D771CD60ABA4
                                                            Function 00C80B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            • Unexpected call to CabWrite()., xrefs: 00C80BC1
                                                            • Failed to write during cabinet extraction., xrefs: 00C80C35
                                                            • cabextract.cpp, xrefs: 00C80C2B
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastWrite_memcpy_s
                                                            • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                            • API String ID: 1970631241-3111339858
                                                            • Opcode ID: d383453e34b73bab3eb2a1d8e183144ae4a05ed197c3d3bcd647ed5442339eb3
                                                            • Instruction ID: 2bc356a0c04ce308ec3f3b022811cbc59de9e20210b9d7350bad45d508d56185
                                                            • Opcode Fuzzy Hash: d383453e34b73bab3eb2a1d8e183144ae4a05ed197c3d3bcd647ed5442339eb3
                                                            • Instruction Fuzzy Hash: BA210476500205ABCB50EF6DC985E9A37A8FF89328F214159FE14C7242D732DD00DB65
                                                            Function 00CA0879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • OpenProcessToken.ADVAPI32(?,00000008,?,00C653BD,00000000,?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA0897
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA08A1
                                                            • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA08D3
                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA08EC
                                                            • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00C7769D,00000000), ref: 00CA092B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastToken$CloseHandleInformationOpenProcess
                                                            • String ID: procutil.cpp
                                                            • API String ID: 4040495316-1178289305
                                                            • Opcode ID: c85e7b49d991c5f7beeaf542b6cf71d607c83423963978b689d99f7b9e1a4c84
                                                            • Instruction ID: 3725951831dcbf98e431f9908814effe2a00fc870f6036e51beeca7ed160ebf1
                                                            • Opcode Fuzzy Hash: c85e7b49d991c5f7beeaf542b6cf71d607c83423963978b689d99f7b9e1a4c84
                                                            • Instruction Fuzzy Hash: 5821C672D4022AEBD7219BA58905B9FBBB8EF16794F214166ED14EB291D3708E00DBD0
                                                            Function 00C80C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00C80CC4
                                                            • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C80CD6
                                                            • SetFileTime.KERNELBASE(?,?,?,?), ref: 00C80CE9
                                                            • CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00C808B1,?,?), ref: 00C80CF8
                                                            Strings
                                                            • Invalid operation for this state., xrefs: 00C80C9D
                                                            • cabextract.cpp, xrefs: 00C80C93
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Time$File$CloseDateHandleLocal
                                                            • String ID: Invalid operation for this state.$cabextract.cpp
                                                            • API String ID: 609741386-1751360545
                                                            • Opcode ID: eb4929bdac6fe2b266b5047b01ea4722ae20e56200e1424b38d36674ed8bf0eb
                                                            • Instruction ID: 8a6b43001602cb1993cb8cb2112cf113efef08b9937137e057ca4904bb125295
                                                            • Opcode Fuzzy Hash: eb4929bdac6fe2b266b5047b01ea4722ae20e56200e1424b38d36674ed8bf0eb
                                                            • Instruction Fuzzy Hash: 9321C37280021AAB8760AFA8CD49AEE7BBCFF05724B204317F864D7591D375EA15CB94
                                                            Function 00CA3565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CoInitialize.OLE32(00000000), ref: 00CA3574
                                                            • InterlockedIncrement.KERNEL32(00CCB6C8), ref: 00CA3591
                                                            • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00CCB6B8,?,?,?,?,?,?), ref: 00CA35AC
                                                            • CLSIDFromProgID.OLE32(MSXML.DOMDocument,00CCB6B8,?,?,?,?,?,?), ref: 00CA35B8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FromProg$IncrementInitializeInterlocked
                                                            • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                            • API String ID: 2109125048-2356320334
                                                            • Opcode ID: 4ab9baa07c3b08434cbef8ff33d1d27f367213ec33b48d9f6ccba2e7e04ce41a
                                                            • Instruction ID: f27dd1da3dbd9a23dbd6e5074365770b9c03eb9f92f483616d7ba0ad69b82a06
                                                            • Opcode Fuzzy Hash: 4ab9baa07c3b08434cbef8ff33d1d27f367213ec33b48d9f6ccba2e7e04ce41a
                                                            • Instruction Fuzzy Hash: EEF0A020F4116667C7210BAAEE1EF1E2D699B83B5DF00082EFC40C2160D760DE818AB0
                                                            Function 00CA4A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00CA4A9D
                                                            • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00CA4ACA
                                                            • GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00CA4AF6
                                                            • GetLastError.KERNEL32(00000000,00CAB7A0,?,00000000,?,00000000,?,00000000), ref: 00CA4B34
                                                            • GlobalFree.KERNEL32(00000000), ref: 00CA4B65
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$Global$AllocFree
                                                            • String ID: fileutil.cpp
                                                            • API String ID: 1145190524-2967768451
                                                            • Opcode ID: c63227b775b2e998e1b2f4e562f473a5f48ba616211a3668d096675c89b52ee4
                                                            • Instruction ID: e98ab50199bcd698b1e47ee64c63d42221b89827771e78e785a8ae7697a0dbc1
                                                            • Opcode Fuzzy Hash: c63227b775b2e998e1b2f4e562f473a5f48ba616211a3668d096675c89b52ee4
                                                            • Instruction Fuzzy Hash: DE314436E4062AABC7218A999C01FAFFAB8EF86754F114226FC14E7241E770CD0096E0
                                                            Function 00C7E956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • DefWindowProcW.USER32(?,00000082,?,?), ref: 00C7E985
                                                            • SetWindowLongW.USER32(?,000000EB,00000000), ref: 00C7E994
                                                            • SetWindowLongW.USER32(?,000000EB,?), ref: 00C7E9A8
                                                            • DefWindowProcW.USER32(?,?,?,?), ref: 00C7E9B8
                                                            • GetWindowLongW.USER32(?,000000EB), ref: 00C7E9D2
                                                            • PostQuitMessage.USER32(00000000), ref: 00C7EA31
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Window$Long$Proc$MessagePostQuit
                                                            • String ID:
                                                            • API String ID: 3812958022-0
                                                            • Opcode ID: f5f28742ca96f313afa9934401bc48ac69c8d4f683d86f2130a7512ca1688938
                                                            • Instruction ID: 3e8f5cfa807647e7af6510c0c6e0ae8643e1ad2af97c19151071eee875f903fe
                                                            • Opcode Fuzzy Hash: f5f28742ca96f313afa9934401bc48ac69c8d4f683d86f2130a7512ca1688938
                                                            • Instruction Fuzzy Hash: 23217C72104114BFDF119FA8DC49EAA3B65FF49324F148658FA1A9A1B5C7319D10EB90
                                                            Function 00C80A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00C80B27
                                                            • GetLastError.KERNEL32(?,?,?), ref: 00C80B31
                                                            Strings
                                                            • Failed to move file pointer 0x%x bytes., xrefs: 00C80B62
                                                            • Invalid seek type., xrefs: 00C80ABD
                                                            • cabextract.cpp, xrefs: 00C80B55
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastPointer
                                                            • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                            • API String ID: 2976181284-417918914
                                                            • Opcode ID: 0fa750ddc9d144652e3dee928988c54a6420c9782ca930b737ff0ff6b87765ea
                                                            • Instruction ID: d59e4b88f3117a03cb64ab41d68b57a337e6cd3b54b1be9f954105ce384cf350
                                                            • Opcode Fuzzy Hash: 0fa750ddc9d144652e3dee928988c54a6420c9782ca930b737ff0ff6b87765ea
                                                            • Instruction Fuzzy Hash: 1231D631A4021AFFCB14EF98C884EAEB7A5FF04728F248215FD2497251D330EE149B94
                                                            Function 00C64115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00C7A0E8,00000000,00000000,?,00000000,00C653BD,00000000,?,?,00C6D5B5,?), ref: 00C64123
                                                            • GetLastError.KERNEL32(?,00C7A0E8,00000000,00000000,?,00000000,00C653BD,00000000,?,?,00C6D5B5,?,00000000,00000000), ref: 00C64131
                                                            • CreateDirectoryW.KERNEL32(?,840F01E8,00C65489,?,00C7A0E8,00000000,00000000,?,00000000,00C653BD,00000000,?,?,00C6D5B5,?,00000000), ref: 00C6419A
                                                            • GetLastError.KERNEL32(?,00C7A0E8,00000000,00000000,?,00000000,00C653BD,00000000,?,?,00C6D5B5,?,00000000,00000000), ref: 00C641A4
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CreateDirectoryErrorLast
                                                            • String ID: dirutil.cpp
                                                            • API String ID: 1375471231-2193988115
                                                            • Opcode ID: a88fb42bfc23d2cbbdffb1d0f8443bdc9a1fc9cf338d1ca76264da9a50f0f4dd
                                                            • Instruction ID: 4049d33c4225dd53cd5da681ded6a79896f6eaaf93f56c2c48945d808355d52a
                                                            • Opcode Fuzzy Hash: a88fb42bfc23d2cbbdffb1d0f8443bdc9a1fc9cf338d1ca76264da9a50f0f4dd
                                                            • Instruction Fuzzy Hash: 17112136600335A7DB392AA64CC0B3FB6A4EF77B61F114021FE24EB241E3648E8192D0
                                                            Function 6E8609F8 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: dllmain_raw$dllmain_crt_dispatch
                                                            • String ID:
                                                            • API String ID: 3136044242-0
                                                            • Opcode ID: bcac529f4860c69923dc808619bbd656c07ad71f3017b2afb5bc4b383be74e49
                                                            • Instruction ID: f038666f53f2a05e01183a437e457171aa9864ad48233f1db0630fad45cc71e9
                                                            • Opcode Fuzzy Hash: bcac529f4860c69923dc808619bbd656c07ad71f3017b2afb5bc4b383be74e49
                                                            • Instruction Fuzzy Hash: 36218D72D40619AFDB718ED9C850EAF3B7DEB80BD5F014C15F8186A290E3318D418BA4
                                                            Function 6E856EF9 Relevance: 7.6, APIs: 5, Instructions: 68sleepprocessCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32 ref: 6E856F0A
                                                            • GetModuleFileNameW.KERNEL32(?,00000104), ref: 6E856F22
                                                            • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6E856FB7
                                                            • Sleep.KERNELBASE ref: 6E856FC3
                                                            • ExitProcess.KERNEL32 ref: 6E856FCA
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ModuleProcess$CreateExitFileHandleNameSleep
                                                            • String ID:
                                                            • API String ID: 1732164044-0
                                                            • Opcode ID: 18d2e6acd41142a4a6304e43e539aee6849dd5a00a977919143f62dda649e3ea
                                                            • Instruction ID: b83180126cd3d2ebb3303735dc604f302c06ad601994c6bfd2beaf9632a08483
                                                            • Opcode Fuzzy Hash: 18d2e6acd41142a4a6304e43e539aee6849dd5a00a977919143f62dda649e3ea
                                                            • Instruction Fuzzy Hash: 8321A272810528DADF51AFD8CC48FAF7778FF86740F00086AE609E31A0DB714964DB94
                                                            Function 00C73AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00CA0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00CCAAA0,00000000,?,00CA57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00CA0F80
                                                            • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00C73FB5,feclient.dll,?,00000000,?,?,?,00C64B12), ref: 00C73B42
                                                              • Part of subcall function 00CA10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00CA112B
                                                              • Part of subcall function 00CA10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00CA1163
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$CloseOpen
                                                            • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                            • API String ID: 1586453840-3596319545
                                                            • Opcode ID: cc875c67713e6a714f501d792af695928a873ba3e3eef7615de915869089ed15
                                                            • Instruction ID: bd0be30daa4b052758c3430dbf32193bde1ca02220e92eac4372b051c4a25e26
                                                            • Opcode Fuzzy Hash: cc875c67713e6a714f501d792af695928a873ba3e3eef7615de915869089ed15
                                                            • Instruction Fuzzy Hash: 9011C432B40248BBDB21DB95DC86EBEBBB8EB05750F5080B5E609AB191D7719F81F710
                                                            Function 00CA0764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenA.KERNEL32(00C812CF,00000000,00000000,?,?,?,00CA0013,00C812CF,00C812CF,?,00000000,0000FDE9,?,00C812CF,8007139F,Invalid operation for this state.), ref: 00CA0776
                                                            • WriteFile.KERNELBASE(00000200,00000000,00000000,?,00000000,?,?,00CA0013,00C812CF,00C812CF,?,00000000,0000FDE9,?,00C812CF,8007139F), ref: 00CA07B2
                                                            • GetLastError.KERNEL32(?,?,00CA0013,00C812CF,00C812CF,?,00000000,0000FDE9,?,00C812CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00CA07BC
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastWritelstrlen
                                                            • String ID: logutil.cpp
                                                            • API String ID: 606256338-3545173039
                                                            • Opcode ID: f82151bc679ef049b2562408b39a8d1a4bb71f3abcc44a48d566ad5afb5d7369
                                                            • Instruction ID: 60f0721b28fb67e6f70896740bf071a53a2ccb8a039770c38f926442935a9028
                                                            • Opcode Fuzzy Hash: f82151bc679ef049b2562408b39a8d1a4bb71f3abcc44a48d566ad5afb5d7369
                                                            • Instruction Fuzzy Hash: 4C11EC7290012AAB8320CA65CD85FAFBB6CFB467E4F210224FD11D7240D731ED00DAE0
                                                            Function 00C809EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00C8140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00C80A19,?,?,?), ref: 00C81434
                                                              • Part of subcall function 00C8140C: GetLastError.KERNEL32(?,00C80A19,?,?,?), ref: 00C8143E
                                                            • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00C80A27
                                                            • GetLastError.KERNEL32 ref: 00C80A31
                                                            Strings
                                                            • Failed to read during cabinet extraction., xrefs: 00C80A5F
                                                            • cabextract.cpp, xrefs: 00C80A55
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLast$PointerRead
                                                            • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                            • API String ID: 2170121939-2426083571
                                                            • Opcode ID: 0e00f53692f3693185181b8bbf15c8f44bd663afbdcb2de03258294b616b20f4
                                                            • Instruction ID: 06040dd21d42e073c6a468c743773897d90922ba9aa26d9e250b5d7473a053b9
                                                            • Opcode Fuzzy Hash: 0e00f53692f3693185181b8bbf15c8f44bd663afbdcb2de03258294b616b20f4
                                                            • Instruction Fuzzy Hash: 4C11CE36A00229BBCB25AFA5DC08E9E7B68FF09768F214115FD14A7251D7309D10ABD4
                                                            Function 00C8140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00C80A19,?,?,?), ref: 00C81434
                                                            • GetLastError.KERNEL32(?,00C80A19,?,?,?), ref: 00C8143E
                                                            Strings
                                                            • Failed to move to virtual file pointer., xrefs: 00C8146C
                                                            • cabextract.cpp, xrefs: 00C81462
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorFileLastPointer
                                                            • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                            • API String ID: 2976181284-3005670968
                                                            • Opcode ID: d6781d13c49eae57ee1f957536c4a8eec1a81a496e70a9f5f5688537e52b6be2
                                                            • Instruction ID: b8582a378341f148d0386d66421dfd35acabfab97f173bcef583ab21aa2e23d0
                                                            • Opcode Fuzzy Hash: d6781d13c49eae57ee1f957536c4a8eec1a81a496e70a9f5f5688537e52b6be2
                                                            • Instruction Fuzzy Hash: 6701A23794063AB7C7216A968C08BCBBF68EF417B4B158126FD285B251D731DC11D7D8
                                                            Function 00C807B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SetEvent.KERNEL32(00CAB478,00000000,?,00C81717,?,00000000,?,00C6C287,?,00C65405,?,00C775A5,?,?,00C65405,?), ref: 00C807BF
                                                            • GetLastError.KERNEL32(?,00C81717,?,00000000,?,00C6C287,?,00C65405,?,00C775A5,?,?,00C65405,?,00C65445,00000001), ref: 00C807C9
                                                            Strings
                                                            • Failed to set begin operation event., xrefs: 00C807F7
                                                            • cabextract.cpp, xrefs: 00C807ED
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorEventLast
                                                            • String ID: Failed to set begin operation event.$cabextract.cpp
                                                            • API String ID: 3848097054-4159625223
                                                            • Opcode ID: dc3f67d13b2116119de600956cd3ebd04de61f42c75090ea5dc9bbf0fa80e895
                                                            • Instruction ID: f939f873e61c4c10ac41abf87989ba5d4687c5aaeeefda9543cce4a1e7c97311
                                                            • Opcode Fuzzy Hash: dc3f67d13b2116119de600956cd3ebd04de61f42c75090ea5dc9bbf0fa80e895
                                                            • Instruction Fuzzy Hash: FFF0EC37A4263167822472955D05BCF76889F05FB5F214135FE41B7181E620AC40D7ED
                                                            Function 6E8673FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                            • API String ID: 0-4115608402
                                                            • Opcode ID: 0032ae318742627c1b6655f83a8fc1c6ea5fd96c5ad0fc58c46205967b80c3d2
                                                            • Instruction ID: f69b62f6d730da883b8b4760665078c973775d0ac3d903179816ab38a379197b
                                                            • Opcode Fuzzy Hash: 0032ae318742627c1b6655f83a8fc1c6ea5fd96c5ad0fc58c46205967b80c3d2
                                                            • Instruction Fuzzy Hash: 41418471A40619AFCB11DFDD8D8499FBBBCEB86314B1009A6E504D7281E7718A41CBD1
                                                            Function 00C65123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00C61104,?,?,00000000), ref: 00C65142
                                                            • CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00C61104,?,?,00000000), ref: 00C65172
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CompareStringlstrlen
                                                            • String ID: burn.clean.room
                                                            • API String ID: 1433953587-3055529264
                                                            • Opcode ID: 0100dcd0aab747332882bae27630aa0a85c7e9f4e34f08a0d36fd6390b40f110
                                                            • Instruction ID: a1400a413ad6b09ad8122e3eb17cbd6c386d3da452389ea4bcc0555e3b648633
                                                            • Opcode Fuzzy Hash: 0100dcd0aab747332882bae27630aa0a85c7e9f4e34f08a0d36fd6390b40f110
                                                            • Instruction Fuzzy Hash: 3A0162726005247F87304B49DDC8F7FB7ACEB16768F204216F516C3650D3709C41DAA1
                                                            Function 00C63838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00C63877
                                                            • GetLastError.KERNEL32 ref: 00C63881
                                                            • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00C638EA
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: DirectoryErrorLastLibraryLoadSystem
                                                            • String ID:
                                                            • API String ID: 1230559179-0
                                                            • Opcode ID: fa24e8915c376817c7e1c7d509966739f320474b14ae8f40014898045e5af189
                                                            • Instruction ID: f4da93bd1791a2fe4b6906bb56d09877c7fda0f6a7b8c294fd72586fa7300c2a
                                                            • Opcode Fuzzy Hash: fa24e8915c376817c7e1c7d509966739f320474b14ae8f40014898045e5af189
                                                            • Instruction Fuzzy Hash: 0621F8B2D0133D67DB309B658C89F9EB7689B04710F1101A5BE14E7281D774DE408BE0
                                                            Function 00C63A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00C63BB6,00000000,?,00C61474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00C613B8), ref: 00C63A20
                                                            • RtlFreeHeap.NTDLL(00000000,?,00C63BB6,00000000,?,00C61474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00C613B8,000001C7,00000100), ref: 00C63A27
                                                            • GetLastError.KERNEL32(?,00C63BB6,00000000,?,00C61474,00000000,80004005,00000000,80004005,00000000,000001C7,?,00C613B8,000001C7,00000100,?), ref: 00C63A31
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$ErrorFreeLastProcess
                                                            • String ID:
                                                            • API String ID: 406640338-0
                                                            • Opcode ID: 2d610a57419f7255c81cd609d0394ebe4d2b77254f31b264e4d7d28a65dc0c5b
                                                            • Instruction ID: 7759367bd64f74b7357d5dac2cdaa8b3769fe27fe29d19f004f43d50d4bf70a1
                                                            • Opcode Fuzzy Hash: 2d610a57419f7255c81cd609d0394ebe4d2b77254f31b264e4d7d28a65dc0c5b
                                                            • Instruction Fuzzy Hash: 31D01273A0413957873117E65D5CB5F7E58EF05AA57014121FE54D7223D725CD00A6E4
                                                            Function 00C6F755 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00CA0F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00CCAAA0,00000000,?,00CA57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00CA0F80
                                                            • RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00C77D59,?,?,?), ref: 00C6F7B9
                                                              • Part of subcall function 00CA1026: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,?,00000000,?,?,?,00C6F78E,00000000,Installed,00000000,?), ref: 00CA104B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CloseOpenQueryValue
                                                            • String ID: Installed
                                                            • API String ID: 3677997916-3662710971
                                                            • Opcode ID: edb9a59c0a425d05769416dcaa6cd698e91df5b439610adbfede10c60fd7ab60
                                                            • Instruction ID: 3a4c10253d15ab62cfd896d3f74134cb05d998070df66fb080d154b1ac98e830
                                                            • Opcode Fuzzy Hash: edb9a59c0a425d05769416dcaa6cd698e91df5b439610adbfede10c60fd7ab60
                                                            • Instruction Fuzzy Hash: BD016236920118FFCB21DBA4DC86BDEBBB8EF04751F1141A9F900A7150D7755E50D790
                                                            Function 00CA0F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00CCAAA0,00000000,?,00CA57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00CA0F80
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Open
                                                            • String ID: regutil.cpp
                                                            • API String ID: 71445658-955085611
                                                            • Opcode ID: d9069ea744bd59124dcd5c16a77dd50854f66a35b6176ac817d7e7eeb6896b8f
                                                            • Instruction ID: 17b78f340a9b0842ef829827aa83d906b104a8b21e850b12cc067aad7acc6287
                                                            • Opcode Fuzzy Hash: d9069ea744bd59124dcd5c16a77dd50854f66a35b6176ac817d7e7eeb6896b8f
                                                            • Instruction Fuzzy Hash: 37F0F6336021376E9B3005D68C06BABAA49DF867F4F354125BD56BF250E6218C1096F0
                                                            Function 00C63AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(?,000001C7,?,?,00C6226D,?,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000), ref: 00C63B04
                                                            • RtlReAllocateHeap.NTDLL(00000000,?,00C6226D,?,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63B0B
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID:
                                                            • API String ID: 1357844191-0
                                                            • Opcode ID: 8320f3c858f26644955810f4754ca4db707057167cdf6d9d0e54b8c473277cc3
                                                            • Instruction ID: ed1bb2e540ab218239551132fbcc606feedc6af6c69602e044aedf48a89d0bb3
                                                            • Opcode Fuzzy Hash: 8320f3c858f26644955810f4754ca4db707057167cdf6d9d0e54b8c473277cc3
                                                            • Instruction Fuzzy Hash: FCD0C93219420DAB8F005FE8DC1DEAE3BACEB596067048505BA15C2121C739E8209A60
                                                            Function 00C6394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetProcessHeap.KERNEL32(?,000001C7,?,00C62274,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63960
                                                            • RtlAllocateHeap.NTDLL(00000000,?,00C62274,000001C7,00000001,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63967
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$AllocateProcess
                                                            • String ID:
                                                            • API String ID: 1357844191-0
                                                            • Opcode ID: 55068d22e6f9a3c0a4345fd4e9f3d266becaeff50e17996174884ab67ce0dcfa
                                                            • Instruction ID: fe83252b548b0ddcc645bfedcf000ef30a2a782f4328d7de50923bd19ecc2762
                                                            • Opcode Fuzzy Hash: 55068d22e6f9a3c0a4345fd4e9f3d266becaeff50e17996174884ab67ce0dcfa
                                                            • Instruction Fuzzy Hash: 3FC012321A420DAB8B006FF8EC1EE9E3BACBB296067048500BA05C3121C738E8108B60
                                                            Function 00CA35C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • VariantInit.OLEAUT32(?), ref: 00CA35F8
                                                              • Part of subcall function 00CA304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00CA3609,00000000,?,00000000), ref: 00CA3069
                                                              • Part of subcall function 00CA304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00C8C025,?,00C65405,?,00000000,?), ref: 00CA3075
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorHandleInitLastModuleVariant
                                                            • String ID:
                                                            • API String ID: 52713655-0
                                                            • Opcode ID: cc756aaa9aaf0d281c16b6e3f33d4a5b062145a3167398e2318bdf11548ab1ad
                                                            • Instruction ID: a8b62b850c5fafbd3cbfbea669748df65fa4b9c604cf079ddbc39411a44f3842
                                                            • Opcode Fuzzy Hash: cc756aaa9aaf0d281c16b6e3f33d4a5b062145a3167398e2318bdf11548ab1ad
                                                            • Instruction Fuzzy Hash: E4314F76D00269ABCB11DFA8C884ADEB7F4FF09714F01456AFD15AB311D6319E008BA4
                                                            Function 00C9521A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?,00C91F87,?,0000015D,?,?,?,?,00C933E0,000000FF,00000000,?,?), ref: 00C9524C
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AllocateHeap
                                                            • String ID:
                                                            • API String ID: 1279760036-0
                                                            • Opcode ID: 3039fd9018aacb0270f835910d630a3f66560b564127f3623dfc30dc8594645e
                                                            • Instruction ID: 00c69ef27dedde339a3088686e35d65e8040fd56eaa9112cdc496ec8252afd7d
                                                            • Opcode Fuzzy Hash: 3039fd9018aacb0270f835910d630a3f66560b564127f3623dfc30dc8594645e
                                                            • Instruction Fuzzy Hash: F0E02B31501D605BDF3327659C0DF5F37489F923A1F240210ED20930D1CB60CE4243E1
                                                            Function 00C634B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00C78BD3,0000001C,80070490,00000000,00000000,80070490), ref: 00C634D5
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FolderPath
                                                            • String ID:
                                                            • API String ID: 1514166925-0
                                                            • Opcode ID: 50166acca50dc469dade219334e313f8db2f6f46425c19b4a9f5dee8cec16ca4
                                                            • Instruction ID: 54c626370a13e1605a9c27e884aa55a9a1722b37f390eadd8fcb07b04de0efac
                                                            • Opcode Fuzzy Hash: 50166acca50dc469dade219334e313f8db2f6f46425c19b4a9f5dee8cec16ca4
                                                            • Instruction Fuzzy Hash: E8E012722011247BEA222EA15C49DBBBB9CDF053547048051BE40D6051DB62D951D6B4
                                                            Function 00C61361 Relevance: 1.3, APIs: 1, Instructions: 88stringCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00C63BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,00C621CC,000001C7,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63BDB
                                                              • Part of subcall function 00C63BD3: HeapSize.KERNEL32(00000000,?,00C621CC,000001C7,80004005,8007139F,?,?,00CA0267,8007139F,?,00000000,00000000,8007139F), ref: 00C63BE2
                                                            • lstrlenW.KERNEL32(000001C7,000001C7,80004005,00000000,?,cabextract.cpp,000001C7), ref: 00C6139C
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1494358087.0000000000C61000.00000020.00000001.01000000.00000005.sdmp, Offset: 00C60000, based on PE: true
                                                            • Associated: 00000002.00000002.1493248946.0000000000C60000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1495085759.0000000000CAB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1496421835.0000000000CCA000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                            • Associated: 00000002.00000002.1497076321.0000000000CCD000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_c60000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Heap$ProcessSizelstrlen
                                                            • String ID:
                                                            • API String ID: 3492610842-0
                                                            • Opcode ID: e5efd6dba00a2e71948ef3437cfa0adc52145f860375124227a17ca400a50b50
                                                            • Instruction ID: f7ffca2b154e3524f49bf11abba9e7e4f545a6db15194fdfe87de8a3c7906dbb
                                                            • Opcode Fuzzy Hash: e5efd6dba00a2e71948ef3437cfa0adc52145f860375124227a17ca400a50b50
                                                            • Instruction Fuzzy Hash: 2221D832D00118AFCB328F69C88077DB7B5EF94362F1D8165ED5067360DB319E51AB80

                                                            Non-executed Functions

                                                            Function 6E85FBC5 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6E85FBCB
                                                            • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6E85FBD9
                                                            • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6E85FBEA
                                                            • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6E85FBFB
                                                            • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6E85FC0C
                                                            • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 6E85FC1D
                                                            • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 6E85FC2E
                                                            • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 6E85FC3F
                                                            • GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 6E85FC50
                                                            • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 6E85FC61
                                                            • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 6E85FC72
                                                            • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 6E85FC83
                                                            • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 6E85FC94
                                                            • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 6E85FCA5
                                                            • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 6E85FCB6
                                                            • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 6E85FCC7
                                                            • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 6E85FCD8
                                                            • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 6E85FCE9
                                                            • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 6E85FCFA
                                                            • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 6E85FD0B
                                                            • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 6E85FD1C
                                                            • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 6E85FD2D
                                                            • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 6E85FD3E
                                                            • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 6E85FD4F
                                                            • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 6E85FD60
                                                            • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E85FD71
                                                            • GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 6E85FD82
                                                            • GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 6E85FD93
                                                            • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6E85FDA4
                                                            • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6E85FDB5
                                                            • GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 6E85FDC6
                                                            • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 6E85FDD7
                                                            • GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 6E85FDE8
                                                            • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 6E85FDF9
                                                            • GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 6E85FE0A
                                                            • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 6E85FE1B
                                                            • GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 6E85FE2C
                                                            • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 6E85FE3D
                                                            • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 6E85FE4E
                                                            • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 6E85FE5F
                                                            • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 6E85FE70
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$HandleModule
                                                            • String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
                                                            • API String ID: 667068680-295688737
                                                            • Opcode ID: 351a8d092d31baeccc3a987594b39ce5e911960d6ccac6f46eba763cffc4e1d2
                                                            • Instruction ID: 738593c5a3f931c0e120e247dbec643da02ac508ac96402a33a07193464a8530
                                                            • Opcode Fuzzy Hash: 351a8d092d31baeccc3a987594b39ce5e911960d6ccac6f46eba763cffc4e1d2
                                                            • Instruction Fuzzy Hash: 8F610975815E21AFDF11AFF8895C89F3BA8BA5B2423044D9AF60AD6305E776C140CFE4
                                                            Function 6E85DCB0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 437filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetWindowsDirectoryW.KERNEL32(?,00000104,AB947D50,?,00000000,?), ref: 6E85DD09
                                                            • lstrcmpW.KERNEL32(?), ref: 6E85DD18
                                                            • lstrlenW.KERNEL32(?), ref: 6E85DD33
                                                            • FindFirstFileW.KERNEL32(?,00000000,6E884D0C,00000002), ref: 6E85DDF6
                                                            • lstrlenW.KERNEL32(?), ref: 6E85DE0E
                                                            • DeleteFileW.KERNEL32(?,?,?,6E883E14,00000001), ref: 6E85DF2B
                                                            • FindNextFileW.KERNEL32(?,00000000), ref: 6E85DF54
                                                            • DeleteFileW.KERNEL32(?,?,?,?,00000001), ref: 6E85E0C6
                                                            • FindNextFileW.KERNEL32(?,00000000), ref: 6E85E0EF
                                                            • FindClose.KERNEL32(?), ref: 6E85E125
                                                            • RemoveDirectoryW.KERNEL32(?), ref: 6E85E133
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: File$Find$DeleteDirectoryNextlstrlen$CloseFirstRemoveWindowslstrcmp
                                                            • String ID: temp
                                                            • API String ID: 4087283718-190023114
                                                            • Opcode ID: 0a46862f6512ed4f96e712615258d146bb1c7fa44102568c61846a722f178e63
                                                            • Instruction ID: 0f3742cee2d7d67770843224df3d3f4f01cdd227428cac5faaaddce0499afe02
                                                            • Opcode Fuzzy Hash: 0a46862f6512ed4f96e712615258d146bb1c7fa44102568c61846a722f178e63
                                                            • Instruction Fuzzy Hash: F8F19E3190060A8BDB81DFE8CC94BEEB7B5FF15314F148A68E815AB3D0EB359915CB90
                                                            Function 6E857F40 Relevance: 4.6, APIs: 3, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadResource.KERNEL32(00000000,00000000,AB947D50,00000001,00000000,00000000,00000000,6E8779A0,000000FF,?,6E85793D,?,?,?,?,00000000), ref: 6E857F6B
                                                            • LockResource.KERNEL32(00000000,?,6E85793D,?,?,?,?,00000000,80004005,AB947D50,?,?,00000000,6E87792D,000000FF), ref: 6E857F76
                                                            • SizeofResource.KERNEL32(00000000,00000000,?,6E85793D,?,?,?,?,00000000,80004005,AB947D50,?,?,00000000,6E87792D,000000FF), ref: 6E857F84
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Resource$LoadLockSizeof
                                                            • String ID:
                                                            • API String ID: 2853612939-0
                                                            • Opcode ID: d4c66f00bcc3ed3429ceb12d8969e08d0878e4a3f3341f9bba7c1b84ad85340e
                                                            • Instruction ID: cfbadf060e3303eecdda252bfde9fe4c81887c47146f73ee519dde7491ea00af
                                                            • Opcode Fuzzy Hash: d4c66f00bcc3ed3429ceb12d8969e08d0878e4a3f3341f9bba7c1b84ad85340e
                                                            • Instruction Fuzzy Hash: 86110D339085159BCB74CF59D848B6AB7FCE785711F108D6BEC19C33C0EA369810C690
                                                            Function 6E85FEFC Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • InitializeCriticalSectionAndSpinCount.KERNEL32(6E88BE60,00000FA0,?,?,6E85FEDA), ref: 6E85FF08
                                                            • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,6E85FEDA), ref: 6E85FF13
                                                            • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6E85FEDA), ref: 6E85FF24
                                                            • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 6E85FF36
                                                            • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 6E85FF44
                                                            • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,6E85FEDA), ref: 6E85FF67
                                                            • ___scrt_fastfail.LIBCMT ref: 6E85FF78
                                                            • DeleteCriticalSection.KERNEL32(6E88BE60,00000007,?,?,6E85FEDA), ref: 6E85FF83
                                                            • CloseHandle.KERNEL32(00000000,?,?,6E85FEDA), ref: 6E85FF93
                                                            Strings
                                                            • kernel32.dll, xrefs: 6E85FF1F
                                                            • WakeAllConditionVariable, xrefs: 6E85FF3C
                                                            • api-ms-win-core-synch-l1-2-0.dll, xrefs: 6E85FF0E
                                                            • SleepConditionVariableCS, xrefs: 6E85FF30
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
                                                            • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                            • API String ID: 3578986977-3242537097
                                                            • Opcode ID: 684cc7af8066e286b593393c97d6c5b49d7f3ad3b0fd7e571c6b25b5f0cd19fc
                                                            • Instruction ID: 3ea6f439ad8a9b30fd7aa87386ad5e290142fe71217d27c93eff9ade7c0589f7
                                                            • Opcode Fuzzy Hash: 684cc7af8066e286b593393c97d6c5b49d7f3ad3b0fd7e571c6b25b5f0cd19fc
                                                            • Instruction Fuzzy Hash: F0015E75904E22AFEF611AF9880CA1F3769AB93B417114DA1FE09D6348EF60D400CAE4
                                                            Function 6E86EAA7 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • ___free_lconv_mon.LIBCMT ref: 6E86EAEB
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EDE1
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EDF3
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE05
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE17
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE29
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE3B
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE4D
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE5F
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE71
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE83
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EE95
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EEA7
                                                              • Part of subcall function 6E86EDC4: _free.LIBCMT ref: 6E86EEB9
                                                            • _free.LIBCMT ref: 6E86EAE0
                                                              • Part of subcall function 6E868D85: HeapFree.KERNEL32(00000000,00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000), ref: 6E868D9B
                                                              • Part of subcall function 6E868D85: GetLastError.KERNEL32(00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000,00000000), ref: 6E868DAD
                                                            • _free.LIBCMT ref: 6E86EB02
                                                            • _free.LIBCMT ref: 6E86EB17
                                                            • _free.LIBCMT ref: 6E86EB22
                                                            • _free.LIBCMT ref: 6E86EB44
                                                            • _free.LIBCMT ref: 6E86EB57
                                                            • _free.LIBCMT ref: 6E86EB65
                                                            • _free.LIBCMT ref: 6E86EB70
                                                            • _free.LIBCMT ref: 6E86EBA8
                                                            • _free.LIBCMT ref: 6E86EBAF
                                                            • _free.LIBCMT ref: 6E86EBCC
                                                            • _free.LIBCMT ref: 6E86EBE4
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                            • String ID:
                                                            • API String ID: 161543041-0
                                                            • Opcode ID: 2c44f6e00e3ffcb60245e0cc0b4c2af2a05a9d923892d2bae999dbea6e462eac
                                                            • Instruction ID: 802de282a380ff18287f26861c346c845915367f614124f0efc1b5211afad919
                                                            • Opcode Fuzzy Hash: 2c44f6e00e3ffcb60245e0cc0b4c2af2a05a9d923892d2bae999dbea6e462eac
                                                            • Instruction Fuzzy Hash: 8B315A716043059FEB629BB9DC44B9A73F9EF41355F144D2AE05AEB194DF30EA808B20
                                                            Function 6E862DC4 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • IsInExceptionSpec.LIBVCRUNTIME ref: 6E862EBF
                                                            • type_info::operator==.LIBVCRUNTIME ref: 6E862EE6
                                                            • ___TypeMatch.LIBVCRUNTIME ref: 6E862FF2
                                                            • IsInExceptionSpec.LIBVCRUNTIME ref: 6E8630CD
                                                            • _UnwindNestedFrames.LIBCMT ref: 6E863154
                                                            • CallUnexpected.LIBVCRUNTIME ref: 6E86316F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                            • String ID: csm$csm$csm
                                                            • API String ID: 2123188842-393685449
                                                            • Opcode ID: 7f3ff58bc4e81067e35299358a8a167384a932d27a0116c7f273bc0b8fc2918a
                                                            • Instruction ID: 5e4e4b7af89bcd145e4165e1b0d5543a6cae99d402c9982daf23cf8a194db41f
                                                            • Opcode Fuzzy Hash: 7f3ff58bc4e81067e35299358a8a167384a932d27a0116c7f273bc0b8fc2918a
                                                            • Instruction Fuzzy Hash: CDC18B71800209EFCF15CFE8C884ADEBBB9BF44314F004DAAE814AB255D775DA55CB91
                                                            Function 6E874BA3 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a7f995d081395a19776eedaef592c22183a34bbb2274a6d248e2142cc22144cb
                                                            • Instruction ID: 9f38e8770bf174d1c23e1f44e40617d62c0450e44fd270887e4d694cd059da95
                                                            • Opcode Fuzzy Hash: a7f995d081395a19776eedaef592c22183a34bbb2274a6d248e2142cc22144cb
                                                            • Instruction Fuzzy Hash: E8C10271E046499FDF11CFDCC880BAE7BB4BF8A364F004D59E964AB292D7709942CB61
                                                            Function 6E851E40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • #17.MSI(00000001,AB947D50,00000010,6D5037E0,?,?,6E8538D6,00000000), ref: 6E851E6F
                                                            • #125.MSI(00000000,00000000,00000000,?,6E8538D6), ref: 6E851E8D
                                                            • #171.MSI(?,00000000,6E883DCC,?), ref: 6E851EC6
                                                            • #171.MSI(?,00000000,00000000,00000000), ref: 6E851F03
                                                            • #8.MSI(00000000,?,6E8538D6), ref: 6E851F1E
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: #171$#125
                                                            • String ID: 0dPm7Pm zPm
                                                            • API String ID: 2925273118-2145367184
                                                            • Opcode ID: c79c526a3f700af77b07be826e153867d20cb92b1ec73f3f355e9b86449983f0
                                                            • Instruction ID: feb2e080714a625c3c2f3da28b970843ba14da1245b548a3bb6bb314fac2cdfb
                                                            • Opcode Fuzzy Hash: c79c526a3f700af77b07be826e153867d20cb92b1ec73f3f355e9b86449983f0
                                                            • Instruction Fuzzy Hash: 7221D3B1900615AFDF108F94CD49BAFBBBCFB46754F10496AE81997380EB719904CBA1
                                                            Function 6E851F40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • #17.MSI(00000001,AB947D50,00000010,00000000,00000000,?,00000000,6E87694D,000000FF,?,6E855F8E,?,00001045,01000010,00000000,?), ref: 6E851F8F
                                                            • #121.MSI(00000000,00000001,?,?,00000000,6E87694D,000000FF,?,6E855F8E,?,00001045,01000010,00000000,?,?,?), ref: 6E851FA7
                                                            • #125.MSI(00000000,00000002,?,?,00000000,6E87694D,000000FF,?,6E855F8E,?,00001045,01000010,00000000,?,?,?), ref: 6E851FD0
                                                            • #103.MSI(00000000,?,00000000,?,00000000,6E87694D,000000FF,?,6E855F8E,?,00001045,01000010,00000000,?,?,?), ref: 6E851FDF
                                                            • #8.MSI(00000000,?,00000000,6E87694D,000000FF,?,6E855F8E,?,00001045,01000010,00000000,?,?,?,?,?), ref: 6E851FF3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: #103#121#125
                                                            • String ID: 0dPm7Pm zPm
                                                            • API String ID: 35833458-2145367184
                                                            • Opcode ID: 85a2ad2776c39dfdb7eec3ca72dbcaf816c35d9321c25c374808cf98d8f31339
                                                            • Instruction ID: 8723309937fdc7aa8659f42c25d0bc1ccad7d66d5bb55a98fc8781b6fe591d2b
                                                            • Opcode Fuzzy Hash: 85a2ad2776c39dfdb7eec3ca72dbcaf816c35d9321c25c374808cf98d8f31339
                                                            • Instruction Fuzzy Hash: 0121B336504A59EFDB508F44CC48BAEB7B8FB46725F004A6AFC1AD3380DB359905CB90
                                                            Function 6E86BB7D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: api-ms-$ext-ms-
                                                            • API String ID: 0-537541572
                                                            • Opcode ID: 97fd26f50d6d0d311a1d2cc2e7b08310e8dc7b90e10cbc4947443537e0d536e5
                                                            • Instruction ID: 05d4cb124b43284344260469d731f3292612e2e3deb5c04816e0339c95659a6e
                                                            • Opcode Fuzzy Hash: 97fd26f50d6d0d311a1d2cc2e7b08310e8dc7b90e10cbc4947443537e0d536e5
                                                            • Instruction Fuzzy Hash: 9E212732945625EBDB118AE9CC44B5E3768AF027A8F100D61FC15AB2C8EB31EE00C6E0
                                                            Function 6E86EF63 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 6E86EF2B: _free.LIBCMT ref: 6E86EF50
                                                            • _free.LIBCMT ref: 6E86EFB1
                                                              • Part of subcall function 6E868D85: HeapFree.KERNEL32(00000000,00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000), ref: 6E868D9B
                                                              • Part of subcall function 6E868D85: GetLastError.KERNEL32(00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000,00000000), ref: 6E868DAD
                                                            • _free.LIBCMT ref: 6E86EFBC
                                                            • _free.LIBCMT ref: 6E86EFC7
                                                            • _free.LIBCMT ref: 6E86F01B
                                                            • _free.LIBCMT ref: 6E86F026
                                                            • _free.LIBCMT ref: 6E86F031
                                                            • _free.LIBCMT ref: 6E86F03C
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _free$ErrorFreeHeapLast
                                                            • String ID:
                                                            • API String ID: 776569668-0
                                                            • Opcode ID: edf75565de582d5b4709286c87f4e6303384ef39f3644e4326d7421dc00d716f
                                                            • Instruction ID: 7e057231736301f34790e7807e3fb4a84468a66fdfc5b6800c39c95a363a3bd9
                                                            • Opcode Fuzzy Hash: edf75565de582d5b4709286c87f4e6303384ef39f3644e4326d7421dc00d716f
                                                            • Instruction Fuzzy Hash: 0A115E71560B04FBD621BBF4DC06FCBB7ACAF49708F840C55A69EAA094DB65B6048760
                                                            Function 6E862A8D Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(00000001,?,6E8627F8,6E860195,6E860819,?,6E860A51,?,00000001,?,?,00000001,?,6E8894B8,0000000C,6E860B4A), ref: 6E862A9B
                                                            • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E862AA9
                                                            • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E862AC2
                                                            • SetLastError.KERNEL32(00000000,6E860A51,?,00000001,?,?,00000001,?,6E8894B8,0000000C,6E860B4A,?,00000001,?), ref: 6E862B14
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastValue___vcrt_
                                                            • String ID:
                                                            • API String ID: 3852720340-0
                                                            • Opcode ID: f57849dcb985eedf8d604b3e12a94233a3def99e64cf1035e549f86bca50eb10
                                                            • Instruction ID: d487341aa95ef63a29467c229becd1e017fdce684798f0c38f706e76c6ec36d5
                                                            • Opcode Fuzzy Hash: f57849dcb985eedf8d604b3e12a94233a3def99e64cf1035e549f86bca50eb10
                                                            • Instruction Fuzzy Hash: F301F53222AA225FEB6006FDAC8CB87276CEB877797200E69F424560E4FF554800E180
                                                            Function 6E86DF0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            • C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe, xrefs: 6E86DF11
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: C:\Windows\Temp\{12BAD9F7-3C4E-4BA3-8461-CD66EE5D2963}\.cr\1wrLmYiC62.exe
                                                            • API String ID: 0-4115608402
                                                            • Opcode ID: 4e67e7b188aef401765440c669a922ac136d636637e90adb63864739abe6aceb
                                                            • Instruction ID: 00f065f2aae1d25f55b6bcec3b443d208d3c339b2ba30cdff0598f212d1c806a
                                                            • Opcode Fuzzy Hash: 4e67e7b188aef401765440c669a922ac136d636637e90adb63864739abe6aceb
                                                            • Instruction Fuzzy Hash: 60216F71618609AF9B51AFE9CD80A9B77ADEF4136C7204D14F528D71D0EB31EC518BA0
                                                            Function 6E863B33 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • FreeLibrary.KERNEL32(00000000,?,?,6E863BF4,00000000,?,00000001,00000000,?,6E863C6B,00000001,FlsFree,6E87C198,6E87C1A0,00000000), ref: 6E863BC3
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: FreeLibrary
                                                            • String ID: api-ms-
                                                            • API String ID: 3664257935-2084034818
                                                            • Opcode ID: 2f50f530c19d20f4a415b0378cfb31738451fc34eacf523c141495a05dfc0533
                                                            • Instruction ID: ed59159b252749d249bd00aa0fae9d6f3080c5c347c15366a3321000a636c0e6
                                                            • Opcode Fuzzy Hash: 2f50f530c19d20f4a415b0378cfb31738451fc34eacf523c141495a05dfc0533
                                                            • Instruction Fuzzy Hash: 1A118632A55A35ABEF628AED8C48B4D33A4AF82770F110E50E915EB2C4DB60ED0487D5
                                                            Function 6E86EEC2 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • _free.LIBCMT ref: 6E86EEDA
                                                              • Part of subcall function 6E868D85: HeapFree.KERNEL32(00000000,00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000), ref: 6E868D9B
                                                              • Part of subcall function 6E868D85: GetLastError.KERNEL32(00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000,00000000), ref: 6E868DAD
                                                            • _free.LIBCMT ref: 6E86EEEC
                                                            • _free.LIBCMT ref: 6E86EEFE
                                                            • _free.LIBCMT ref: 6E86EF10
                                                            • _free.LIBCMT ref: 6E86EF22
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _free$ErrorFreeHeapLast
                                                            • String ID:
                                                            • API String ID: 776569668-0
                                                            • Opcode ID: e830e81ec4113879b1bac2bbddcd494ac7c4354f8698e5c597bd85ec031e200d
                                                            • Instruction ID: 1fa05f81342207bdc8c8e37e40609e93649779721c14cb8152f7166aa8965704
                                                            • Opcode Fuzzy Hash: e830e81ec4113879b1bac2bbddcd494ac7c4354f8698e5c597bd85ec031e200d
                                                            • Instruction Fuzzy Hash: C3F06D71514B499BCA61CBECE881C5B33FDAAD33167640C05F42DDB584CB30F8808BA4
                                                            Function 6E85FFC1 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(6E88BE60,?,?,6E85840E,6E88C984,6E879270), ref: 6E85FFCB
                                                            • LeaveCriticalSection.KERNEL32(6E88BE60,?,?,6E85840E,6E88C984,6E879270), ref: 6E85FFFE
                                                            • RtlWakeAllConditionVariable.NTDLL ref: 6E860075
                                                            • SetEvent.KERNEL32(?,6E85840E,6E88C984,6E879270), ref: 6E86007F
                                                            • ResetEvent.KERNEL32(?,6E85840E,6E88C984,6E879270), ref: 6E86008B
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
                                                            • String ID:
                                                            • API String ID: 3916383385-0
                                                            • Opcode ID: 29a6f2db992a4c9564a43d6802a45e17585883f10405ce0f2f2b2c923bf786ff
                                                            • Instruction ID: 66654db3660e94934fb25c5c9dd96815ad55669da4df787cb23896bf571dd7d3
                                                            • Opcode Fuzzy Hash: 29a6f2db992a4c9564a43d6802a45e17585883f10405ce0f2f2b2c923bf786ff
                                                            • Instruction Fuzzy Hash: 10018C39500E24DFCF129F5CE84899A3BA9FB8B71170044AAEE1E97319CB30AC01CBD4
                                                            Function 6E862B6D Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: AdjustPointer
                                                            • String ID:
                                                            • API String ID: 1740715915-0
                                                            • Opcode ID: d0ea045e46130d722ae32cdb5d7f7df25080276a385fdadf89cc9bbcffc50cf7
                                                            • Instruction ID: a3dca604b6714498d4a7cf457927ccc8cabb4e51102b19996ad71d406c6a34a8
                                                            • Opcode Fuzzy Hash: d0ea045e46130d722ae32cdb5d7f7df25080276a385fdadf89cc9bbcffc50cf7
                                                            • Instruction Fuzzy Hash: AA51BF72A0560ADFEB158FD9D850BAA73B9FF44314F104DA9ED1557290E739E880C790
                                                            Function 6E868AE9 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLastError.KERNEL32(?,?,?,6E865E82,6E86B095,?,6E86648B,?,00000004,?,?,?,?,6E867A4B,?,?), ref: 6E868AEE
                                                            • _free.LIBCMT ref: 6E868B4B
                                                            • _free.LIBCMT ref: 6E868B81
                                                            • SetLastError.KERNEL32(00000000,0000000A,000000FF,?,6E86648B,?,00000004,?,?,?,?,6E867A4B,?,?,00000004), ref: 6E868B8C
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast_free
                                                            • String ID:
                                                            • API String ID: 2283115069-0
                                                            • Opcode ID: 22ce7675b81676d744c8cb809a2e5d6cd7d63e571cefe03e1bc562f1a7297a48
                                                            • Instruction ID: 8801e5a5af986840d2c2a20f59b52fbcb71d21ef2db192edfbaf3314e9b5aa60
                                                            • Opcode Fuzzy Hash: 22ce7675b81676d744c8cb809a2e5d6cd7d63e571cefe03e1bc562f1a7297a48
                                                            • Instruction Fuzzy Hash: 501169B52446056FDA5216FD9C94F9B276DABC367DB280F24F53C9A1E9EF2188018160
                                                            Function 6E867CE4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _free.LIBCMT ref: 6E867CED
                                                              • Part of subcall function 6E868D85: HeapFree.KERNEL32(00000000,00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000), ref: 6E868D9B
                                                              • Part of subcall function 6E868D85: GetLastError.KERNEL32(00000000,?,6E86EF55,00000000,00000000,00000000,?,?,6E86EF7C,00000000,00000007,00000000,?,6E86EC3E,00000000,00000000), ref: 6E868DAD
                                                            • _free.LIBCMT ref: 6E867D00
                                                            • _free.LIBCMT ref: 6E867D11
                                                            • _free.LIBCMT ref: 6E867D22
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: _free$ErrorFreeHeapLast
                                                            • String ID:
                                                            • API String ID: 776569668-0
                                                            • Opcode ID: 58e5957aceec49a11b47413ed8284c0339f1d9d0924c1c0e6d8c8bf014c1222b
                                                            • Instruction ID: 49d9c180b2d2a2da0cd301c19e733f7fb0b3d7cca51cb354dd0701f77770ac92
                                                            • Opcode Fuzzy Hash: 58e5957aceec49a11b47413ed8284c0339f1d9d0924c1c0e6d8c8bf014c1222b
                                                            • Instruction Fuzzy Hash: 99E092B1861F609BCE125F9CA80488B3B69B79BA253050B86E80D5E21EE7311512DED6
                                                            Function 6E85EC60 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 232COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: HeapProcess
                                                            • String ID: BIN\STSADM.EXE$Location
                                                            • API String ID: 54951025-3562773343
                                                            • Opcode ID: c3e051ee956db9a545eb83a7232a67f1f899c35bf263b8d7816accfd9785e7a4
                                                            • Instruction ID: 124008ddcd11e25e0a2799b1f995ccaecae95a4a9510cb88e7220282eb0aaebf
                                                            • Opcode Fuzzy Hash: c3e051ee956db9a545eb83a7232a67f1f899c35bf263b8d7816accfd9785e7a4
                                                            • Instruction Fuzzy Hash: 3D818A31A0060A9FEB51CFE8CC54BAEBBB8FF05314F148969E911A73C0DB759915CB91
                                                            Function 6E866ADD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • __startOneArgErrorHandling.LIBCMT ref: 6E866B6D
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID: ErrorHandling__start
                                                            • String ID: pow
                                                            • API String ID: 3213639722-2276729525
                                                            • Opcode ID: 569efce32120b55f813000ea98dc9a9432184c5d5f4f0a78ae627b1726866fc9
                                                            • Instruction ID: 3704c29f0e7d8f3d36ff0952f91136622b8c432079fc70f10751af8d65dd8318
                                                            • Opcode Fuzzy Hash: 569efce32120b55f813000ea98dc9a9432184c5d5f4f0a78ae627b1726866fc9
                                                            • Instruction Fuzzy Hash: B951AC60A38542D7CF017BE8C95039E7BA4EB42711F304D58E0A88A2DDEF75C481EB87
                                                            Function 6E852C30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: \\?\$\\?\UNC\
                                                            • API String ID: 0-3019864461
                                                            • Opcode ID: e262616c39246b0884d1cc2b24bb3380d5e2634265d392477ba6d7c4129a8aed
                                                            • Instruction ID: 139f2f955f93611c57f40bdba4e510ea46b35a2ccdc488f6cdac7f582740de4e
                                                            • Opcode Fuzzy Hash: e262616c39246b0884d1cc2b24bb3380d5e2634265d392477ba6d7c4129a8aed
                                                            • Instruction Fuzzy Hash: 4051AE70A002099BDB55CFE8C954BEEB7B5FF85348F10491EE401A7781DF78A998CB91
                                                            Function 6E851DB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000002.00000002.1501099560.000000006E851000.00000020.00000001.01000000.00000006.sdmp, Offset: 6E850000, based on PE: true
                                                            • Associated: 00000002.00000002.1501052347.000000006E850000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501154374.000000006E87A000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501180692.000000006E88B000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                            • Associated: 00000002.00000002.1501206037.000000006E88D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_2_2_6e850000_1wrLmYiC62.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: zPm
                                                            • API String ID: 0-1370021141
                                                            • Opcode ID: cc0835b76b78f1a82b0f2050bc35fbfaf6b77ac742c2a9e40d4452ac48f6886e
                                                            • Instruction ID: db2858d76c223332259b0a1a0e29d5874642cdbceaf8c0d45245aa4ff15abc46
                                                            • Opcode Fuzzy Hash: cc0835b76b78f1a82b0f2050bc35fbfaf6b77ac742c2a9e40d4452ac48f6886e
                                                            • Instruction Fuzzy Hash: D00184F2111356AFE704CF58D809B6BB79CEB85255F00482AF44697640E775EC15C7B1