Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
HGhGAjCVw5.exe

Overview

General Information

Sample name:HGhGAjCVw5.exe
renamed because original name is a hash value
Original sample name:d4a4e4c891bacb6ffa8884695d7d757d8dbbae18ec64370bac3f6ecc024ea334.exe
Analysis ID:1588132
MD5:4d77d26b50bea6a8755808eb5bec3044
SHA1:19383419c4a21e39c46852059ae240e8ab6cc12f
SHA256:d4a4e4c891bacb6ffa8884695d7d757d8dbbae18ec64370bac3f6ecc024ea334
Tags:AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • HGhGAjCVw5.exe (PID: 1664 cmdline: "C:\Users\user\Desktop\HGhGAjCVw5.exe" MD5: 4D77D26B50BEA6A8755808EB5BEC3044)
    • powershell.exe (PID: 4052 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 7560 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 2740 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 7220 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • HGhGAjCVw5.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\HGhGAjCVw5.exe" MD5: 4D77D26B50BEA6A8755808EB5BEC3044)
  • gdJhjh.exe (PID: 7452 cmdline: C:\Users\user\AppData\Roaming\gdJhjh.exe MD5: 4D77D26B50BEA6A8755808EB5BEC3044)
    • schtasks.exe (PID: 7720 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • gdJhjh.exe (PID: 7764 cmdline: "C:\Users\user\AppData\Roaming\gdJhjh.exe" MD5: 4D77D26B50BEA6A8755808EB5BEC3044)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Agent Tesla, AgentTeslaA .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 15 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.HGhGAjCVw5.exe.40f4448.2.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              0.2.HGhGAjCVw5.exe.40f4448.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                0.2.HGhGAjCVw5.exe.40f4448.2.unpackINDICATOR_SUSPICIOUS_EXE_VaultSchemaGUIDDetects executables referencing Windows vault credential objects. Observed in infostealersditekSHen
                • 0x316ef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5
                • 0x31761:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55
                • 0x317eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F
                • 0x3187d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28
                • 0x318e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29
                • 0x31959:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
                • 0x319ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
                • 0x31a7f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
                0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                  0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    Click to see the 15 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HGhGAjCVw5.exe", ParentImage: C:\Users\user\Desktop\HGhGAjCVw5.exe, ParentProcessId: 1664, ParentProcessName: HGhGAjCVw5.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", ProcessId: 4052, ProcessName: powershell.exe
                    Sigma detected: Powershell Defender Exclusion
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HGhGAjCVw5.exe", ParentImage: C:\Users\user\Desktop\HGhGAjCVw5.exe, ParentProcessId: 1664, ParentProcessName: HGhGAjCVw5.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", ProcessId: 4052, ProcessName: powershell.exe
                    Sigma detected: Suspicious Add Scheduled Task Parent
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\gdJhjh.exe, ParentImage: C:\Users\user\AppData\Roaming\gdJhjh.exe, ParentProcessId: 7452, ParentProcessName: gdJhjh.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp", ProcessId: 7720, ProcessName: schtasks.exe
                    Sigma detected: Suspicious Outbound SMTP Connections
                    Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\HGhGAjCVw5.exe, Initiated: true, ProcessId: 7348, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49708
                    Sigma detected: Suspicious Schtasks From Env Var Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\HGhGAjCVw5.exe", ParentImage: C:\Users\user\Desktop\HGhGAjCVw5.exe, ParentProcessId: 1664, ParentProcessName: HGhGAjCVw5.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", ProcessId: 7220, ProcessName: schtasks.exe
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HGhGAjCVw5.exe", ParentImage: C:\Users\user\Desktop\HGhGAjCVw5.exe, ParentProcessId: 1664, ParentProcessName: HGhGAjCVw5.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe", ProcessId: 4052, ProcessName: powershell.exe

                    Persistence and Installation Behavior

                    barindex
                    Sigma detected: Scheduled temp file as task from temp location
                    Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\HGhGAjCVw5.exe", ParentImage: C:\Users\user\Desktop\HGhGAjCVw5.exe, ParentProcessId: 1664, ParentProcessName: HGhGAjCVw5.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp", ProcessId: 7220, ProcessName: schtasks.exe

                    Suricata Signatures

                    ⊘No Suricata rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: HGhGAjCVw5.exeAvira: detected
                    Antivirus detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeAvira: detection malicious, Label: HEUR/AGEN.1305388
                    Found malware configuration
                    Source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "web@iaa-airferight.com", "Password": "webmaster"}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeReversingLabs: Detection: 71%
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeVirustotal: Detection: 60%Perma Link
                    Multi AV Scanner detection for submitted file
                    Source: HGhGAjCVw5.exeVirustotal: Detection: 60%Perma Link
                    Source: HGhGAjCVw5.exeReversingLabs: Detection: 71%
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeJoe Sandbox ML: detected
                    Machine Learning detection for sample
                    Source: HGhGAjCVw5.exeJoe Sandbox ML: detected
                    Source: HGhGAjCVw5.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: unknownHTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.10:49707 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.10:49711 version: TLS 1.2
                    Source: HGhGAjCVw5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Networking

                    barindex
                    Yara detected Generic Downloader
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPE
                    Source: Joe Sandbox ViewIP Address: 46.175.148.58 46.175.148.58
                    Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
                    Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
                    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                    Source: unknownDNS query: name: api.ipify.org
                    Source: unknownDNS query: name: api.ipify.org
                    Source: global trafficTCP traffic: 192.168.2.10:49708 -> 46.175.148.58:25
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
                    Source: global trafficDNS traffic detected: DNS query: api.ipify.org
                    Source: global trafficDNS traffic detected: DNS query: mail.iaa-airferight.com
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2822698121.000000000321C000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mail.iaa-airferight.com
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1589404165.0000000003310000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000A.00000002.1638208076.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://account.dyn.com/
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/t
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
                    Source: unknownHTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.10:49707 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.10:49711 version: TLS 1.2

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0.2.HGhGAjCVw5.exe.40f4448.2.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.HGhGAjCVw5.exe.4c41e68.1.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.HGhGAjCVw5.exe.4c41e68.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_02EBD4040_2_02EBD404
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07721E7A0_2_07721E7A
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077296C80_2_077296C8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07722CF80_2_07722CF8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07720B900_2_07720B90
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077280A00_2_077280A0
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07724F100_2_07724F10
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07724F000_2_07724F00
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07729FC80_2_07729FC8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07729FBA0_2_07729FBA
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07728E400_2_07728E40
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077296C60_2_077296C6
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077286980_2_07728698
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077286880_2_07728688
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_0772A5700_2_0772A570
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_0772557A0_2_0772557A
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_0772A5600_2_0772A560
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07723D080_2_07723D08
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077255880_2_07725588
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077214400_2_07721440
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07723CF80_2_07723CF8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07722C8B0_2_07722C8B
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07720B770_2_07720B77
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077283580_2_07728358
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077283480_2_07728348
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07720B3F0_2_07720B3F
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077253A80_2_077253A8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077253980_2_07725398
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07720AF70_2_07720AF7
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07723ADA0_2_07723ADA
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07728A900_2_07728A90
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_07728A800_2_07728A80
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077251180_2_07725118
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077251080_2_07725108
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077200400_2_07720040
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077200070_2_07720007
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077218D90_2_077218D9
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 0_2_077280900_2_07728090
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0110E6A19_2_0110E6A1
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0110A94F9_2_0110A94F
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0110D9A89_2_0110D9A8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01104A989_2_01104A98
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01103E809_2_01103E80
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_011041C89_2_011041C8
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0698A0349_2_0698A034
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0698B8809_2_0698B880
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069955889_2_06995588
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069965E09_2_069965E0
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0699B20F9_2_0699B20F
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069930409_2_06993040
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_06997D689_2_06997D68
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069976889_2_06997688
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0699E3889_2_0699E388
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0699234A9_2_0699234A
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069900409_2_06990040
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_06995CD39_2_06995CD3
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069900069_2_06990006
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_02CE4B0110_2_02CE4B01
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_02CED40410_2_02CED404
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074CE61010_2_074CE610
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C96C810_2_074C96C8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C1E8810_2_074C1E88
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C2CF810_2_074C2CF8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C0B9010_2_074C0B90
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C80A010_2_074C80A0
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C9FC810_2_074C9FC8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C4FE810_2_074C4FE8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C4FE210_2_074C4FE2
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C9FBA10_2_074C9FBA
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C8E4010_2_074C8E40
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C8E5010_2_074C8E50
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C1E7A10_2_074C1E7A
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C868810_2_074C8688
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C869810_2_074C8698
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C96B810_2_074C96B8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074CA56010_2_074CA560
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C557A10_2_074C557A
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074CA57010_2_074CA570
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C4DD010_2_074C4DD0
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C4DE010_2_074C4DE0
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C558810_2_074C5588
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C144010_2_074C1440
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C145010_2_074C1450
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C2C9E10_2_074C2C9E
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C2CAD10_2_074C2CAD
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C834810_2_074C8348
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C835810_2_074C8358
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C0B7610_2_074C0B76
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C0B3D10_2_074C0B3D
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C3BC810_2_074C3BC8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C3BD810_2_074C3BD8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C3B9010_2_074C3B90
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C526810_2_074C5268
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C527810_2_074C5278
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C8A8010_2_074C8A80
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C8A9010_2_074C8A90
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C004010_2_074C0040
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C000610_2_074C0006
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C18D910_2_074C18D9
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C18E810_2_074C18E8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 10_2_074C809010_2_074C8090
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_0171E6A114_2_0171E6A1
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_0171A94F14_2_0171A94F
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_01714A9814_2_01714A98
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_01713E8014_2_01713E80
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_017141C814_2_017141C8
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB65E014_2_06DB65E0
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB558814_2_06DB5588
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB7D6814_2_06DB7D68
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DBB20F14_2_06DBB20F
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB304014_2_06DB3040
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB768814_2_06DB7688
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB5CD314_2_06DB5CD3
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DBE38814_2_06DBE388
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB234B14_2_06DB234B
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB004014_2_06DB0040
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB033E14_2_06DB033E
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_06DB000714_2_06DB0007
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1615026108.000000000A950000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1587615048.000000000130E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1589404165.0000000003310000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamec5ea4fda-43b2-4fc0-8a8b-07958574f042.exe4 vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000000.1562867623.0000000000C52000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameRRxZ.exe, vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1610360090.0000000007480000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameArthur.dll" vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1609955220.00000000073AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1609955220.00000000073AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePowerShell.EXEj% vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2819916590.0000000001148000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2818522727.0000000000EF8000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exeBinary or memory string: OriginalFilenameRRxZ.exe, vs HGhGAjCVw5.exe
                    Source: HGhGAjCVw5.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 0.2.HGhGAjCVw5.exe.40f4448.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.HGhGAjCVw5.exe.4c41e68.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.HGhGAjCVw5.exe.4c41e68.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                    Source: HGhGAjCVw5.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: gdJhjh.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@19/15@2/2
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile created: C:\Users\user\AppData\Roaming\gdJhjh.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5840:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5956:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile created: C:\Users\user\AppData\Local\Temp\tmp57CE.tmpJump to behavior
                    Source: HGhGAjCVw5.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: HGhGAjCVw5.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: HGhGAjCVw5.exeVirustotal: Detection: 60%
                    Source: HGhGAjCVw5.exeReversingLabs: Detection: 71%
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile read: C:\Users\user\Desktop\HGhGAjCVw5.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\HGhGAjCVw5.exe "C:\Users\user\Desktop\HGhGAjCVw5.exe"
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp"
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Users\user\Desktop\HGhGAjCVw5.exe "C:\Users\user\Desktop\HGhGAjCVw5.exe"
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\gdJhjh.exe C:\Users\user\AppData\Roaming\gdJhjh.exe
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp"
                    Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Users\user\AppData\Roaming\gdJhjh.exe "C:\Users\user\AppData\Roaming\gdJhjh.exe"
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Users\user\Desktop\HGhGAjCVw5.exe "C:\Users\user\Desktop\HGhGAjCVw5.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Users\user\AppData\Roaming\gdJhjh.exe "C:\Users\user\AppData\Roaming\gdJhjh.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: iconcodecservice.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: vaultcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: dwrite.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: iconcodecservice.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                    Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: uxtheme.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: wldp.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: amsi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: userenv.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rasapi32.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rasman.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rtutils.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: mswsock.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: winhttp.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: dhcpcsvc6.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: dhcpcsvc.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: dnsapi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: winnsi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: rasadhlp.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: fwpuclnt.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: secur32.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: schannel.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: mskeyprotect.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ntasn1.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ncrypt.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: ncryptsslp.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: gpapi.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: vaultcli.dll
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeSection loaded: wintypes.dll
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\ProfilesJump to behavior
                    Source: HGhGAjCVw5.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: HGhGAjCVw5.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01100C53 push ebx; retf 9_2_01100C52
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01100C45 push ebx; retf 9_2_01100C52
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01100C6D push edi; retf 9_2_01100C7A
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_01100CCB push edi; retf 9_2_01100C7A
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_069834DB push es; retf 9_2_069834E4
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_06983A40 push FC06A7DAh; retf 9_2_06983A4D
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeCode function: 9_2_0699FFB0 push es; ret 9_2_0699FFC0
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_01710C6D push edi; retf 14_2_01710C7A
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_01710C45 push ebx; retf 14_2_01710C52
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeCode function: 14_2_01710CCB push edi; retf 14_2_01710C7A
                    Source: HGhGAjCVw5.exeStatic PE information: section name: .text entropy: 7.6842460602118505
                    Source: gdJhjh.exe.0.drStatic PE information: section name: .text entropy: 7.6842460602118505
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile created: C:\Users\user\AppData\Roaming\gdJhjh.exeJump to dropped file

                    Boot Survival

                    barindex
                    Uses schtasks.exe or at.exe to add and modify task schedules
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp"

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Loading BitLocker PowerShell Module
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Yara detected AntiVM3
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 1664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: gdJhjh.exe PID: 7452, type: MEMORYSTR
                    Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 2E70000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 30C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 3000000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 7DD0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 8DD0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 8F80000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 9F80000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: A9D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: B9D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: C9D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 1100000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 31A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: 17D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 13D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 2D40000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 4D40000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 7610000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 8610000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 87A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 97A0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: A1B0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: B1B0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: C1B0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 1710000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 30C0000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeMemory allocated: 50C0000 memory reserve | memory write watch
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 922337203685477
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5556Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6642Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWindow / User API: threadDelayed 4615Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWindow / User API: threadDelayed 5239Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWindow / User API: threadDelayed 1910
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWindow / User API: threadDelayed 7947
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 2092Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7196Thread sleep count: 5556 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7380Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7180Thread sleep count: 59 > 30Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7320Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7404Thread sleep time: -2767011611056431s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7336Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep count: 36 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -33204139332677172s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -100000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7628Thread sleep count: 4615 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99888s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99781s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7628Thread sleep count: 5239 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99665s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99562s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99451s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99343s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99234s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99124s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -99015s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98906s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98796s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98687s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98578s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98468s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98359s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98250s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98137s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -98031s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97921s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97812s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97703s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97593s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97484s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97375s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97265s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97155s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -97046s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96937s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96828s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96718s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96609s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96499s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96390s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96278s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96171s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -96062s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95952s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95843s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95734s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95623s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95515s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95406s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95296s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95187s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -95078s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -94968s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -94859s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -94749s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -94640s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exe TID: 7568Thread sleep time: -94531s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7496Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -26747778906878833s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -100000s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7868Thread sleep count: 1910 > 30
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99875s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7868Thread sleep count: 7947 > 30
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99765s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99656s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99544s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99421s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99312s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99202s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -99091s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98968s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98856s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98734s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98625s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98515s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98406s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98296s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98187s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -98078s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97968s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97857s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97734s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97625s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97515s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97406s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97296s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97187s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -97078s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96968s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96859s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96749s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96640s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96531s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96419s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96296s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96187s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -96066s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95937s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95827s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95716s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95593s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95484s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95372s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95250s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -95140s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94993s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94875s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94765s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94656s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94546s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exe TID: 7864Thread sleep time: -94437s >= -30000s
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 100000Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99888Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99781Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99665Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99562Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99451Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99343Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99234Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99124Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 99015Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98906Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98796Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98687Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98578Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98468Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98359Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98250Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98137Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 98031Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97921Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97812Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97703Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97593Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97484Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97375Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97265Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97155Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 97046Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96937Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96828Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96718Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96609Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96499Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96390Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96278Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96171Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 96062Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95952Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95843Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95734Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95623Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95515Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95406Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95296Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95187Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 95078Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 94968Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 94859Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 94749Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 94640Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeThread delayed: delay time: 94531Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 100000
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99875
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99765
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99656
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99544
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99421
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99312
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99202
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 99091
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98968
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98856
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98734
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98625
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98515
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98406
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98296
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98187
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 98078
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97968
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97857
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97734
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97625
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97515
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97406
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97296
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97187
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 97078
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96968
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96859
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96749
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96640
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96531
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96419
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96296
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96187
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 96066
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95937
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95827
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95716
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95593
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95484
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95372
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95250
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 95140
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94993
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94875
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94765
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94656
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94546
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeThread delayed: delay time: 94437
                    Source: HGhGAjCVw5.exe, 00000000.00000002.1587615048.000000000137F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                    Source: HGhGAjCVw5.exe, 00000009.00000002.2820725559.000000000120E000.00000004.00000020.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2819563019.00000000013E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Adds a directory exclusion to Windows Defender
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeProcess created: C:\Users\user\Desktop\HGhGAjCVw5.exe "C:\Users\user\Desktop\HGhGAjCVw5.exe"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp"Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeProcess created: C:\Users\user\AppData\Roaming\gdJhjh.exe "C:\Users\user\AppData\Roaming\gdJhjh.exe"Jump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Users\user\Desktop\HGhGAjCVw5.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Users\user\Desktop\HGhGAjCVw5.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Users\user\AppData\Roaming\gdJhjh.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Users\user\AppData\Roaming\gdJhjh.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Stealing of Sensitive Information

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2822698121.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2822698121.000000000321C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 1664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 7348, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: gdJhjh.exe PID: 7764, type: MEMORYSTR
                    Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                    Tries to harvest and steal ftp login credentials
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\FTP Navigator\Ftplist.txt
                    Tries to steal Mail credentials (via file / registry access)
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                    Source: C:\Users\user\Desktop\HGhGAjCVw5.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
                    Source: C:\Users\user\AppData\Roaming\gdJhjh.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2822698121.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 1664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 7348, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: gdJhjh.exe PID: 7764, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected AgentTesla
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.40f4448.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4c41e68.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4bc3048.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.HGhGAjCVw5.exe.4b44228.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2822698121.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000009.00000002.2822698121.000000000321C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 1664, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: HGhGAjCVw5.exe PID: 7348, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: gdJhjh.exe PID: 7764, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts121
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		11
                    Disable or Modify Tools                    		2
                    OS Credential Dumping                    		1
                    File and Directory Discovery                    		Remote Services1
                    Archive Collected Data                    		1
                    Ingress Tool Transfer                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job                    		1
                    Scheduled Task/Job                    		11
                    Process Injection                    		2
                    Obfuscated Files or Information                    		1
                    Credentials in Registry                    		24
                    System Information Discovery                    		Remote Desktop Protocol2
                    Data from Local System                    		11
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                    Scheduled Task/Job                    		2
                    Software Packing                    		Security Account Manager1
                    Query Registry                    		SMB/Windows Admin Shares1
                    Email Collection                    		2
                    Non-Application Layer Protocol                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
                    DLL Side-Loading                    		NTDS211
                    Security Software Discovery                    		Distributed Component Object ModelInput Capture23
                    Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    Masquerading                    		LSA Secrets1
                    Process Discovery                    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts141
                    Virtualization/Sandbox Evasion                    		Cached Domain Credentials141
                    Virtualization/Sandbox Evasion                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                    Process Injection                    		DCSync1
                    Application Window Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
                    System Network Configuration Discovery                    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1588132 Sample: HGhGAjCVw5.exe Startdate: 10/01/2025 Architecture: WINDOWS Score: 100 46 mail.iaa-airferight.com 2->46 48 api.ipify.org 2->48 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 8 other signatures 2->60 8 HGhGAjCVw5.exe 7 2->8         started        12 gdJhjh.exe 5 2->12         started        signatures3 process4 file5 38 C:\Users\user\AppData\Roaming\gdJhjh.exe, PE32 8->38 dropped 40 C:\Users\user\...\gdJhjh.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp57CE.tmp, XML 8->42 dropped 44 C:\Users\user\AppData\...\HGhGAjCVw5.exe.log, ASCII 8->44 dropped 62 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->62 64 Uses schtasks.exe or at.exe to add and modify task schedules 8->64 66 Adds a directory exclusion to Windows Defender 8->66 14 HGhGAjCVw5.exe 15 2 8->14         started        18 powershell.exe 23 8->18         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        68 Antivirus detection for dropped file 12->68 70 Multi AV Scanner detection for dropped file 12->70 72 Machine Learning detection for dropped file 12->72 24 gdJhjh.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 50 api.ipify.org 104.26.13.205, 443, 49707, 49711 CLOUDFLARENETUS United States 14->50 52 mail.iaa-airferight.com 46.175.148.58, 25 ASLAGIDKOM-NETUA Ukraine 14->52 74 Loading BitLocker PowerShell Module 18->74 28 conhost.exe 18->28         started        30 WmiPrvSE.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        76 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->76 78 Tries to steal Mail credentials (via file / registry access) 24->78 80 Tries to harvest and steal ftp login credentials 24->80 82 Tries to harvest and steal browser information (history, passwords, etc) 24->82 36 conhost.exe 26->36         started        signatures9 process10

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    HGhGAjCVw5.exe61%VirustotalBrowse
                    HGhGAjCVw5.exe71%ReversingLabsByteCode-MSIL.Backdoor.FormBook
                    HGhGAjCVw5.exe100%AviraHEUR/AGEN.1305388
                    HGhGAjCVw5.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Roaming\gdJhjh.exe100%AviraHEUR/AGEN.1305388
                    C:\Users\user\AppData\Roaming\gdJhjh.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Roaming\gdJhjh.exe71%ReversingLabsByteCode-MSIL.Backdoor.FormBook
                    C:\Users\user\AppData\Roaming\gdJhjh.exe61%VirustotalBrowse

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    ⊘No Antivirus matches

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    mail.iaa-airferight.com
                    		46.175.148.58
                    		truefalse
                      		high
                      api.ipify.org
                      		104.26.13.205
                      		truefalse
                        		high

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        https://api.ipify.org/false
                          		high

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://api.ipify.orgHGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmpfalse
                            		high
                            https://account.dyn.com/HGhGAjCVw5.exe, 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmpfalse
                              		high
                              https://api.ipify.org/tHGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameHGhGAjCVw5.exe, 00000000.00000002.1589404165.0000000003310000.00000004.00000800.00020000.00000000.sdmp, HGhGAjCVw5.exe, 00000009.00000002.2822698121.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000A.00000002.1638208076.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.00000000030C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://mail.iaa-airferight.comHGhGAjCVw5.exe, 00000009.00000002.2822698121.000000000321C000.00000004.00000800.00020000.00000000.sdmp, gdJhjh.exe, 0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    46.175.148.58
                                    		mail.iaa-airferight.comUkraine
                                    		56394ASLAGIDKOM-NETUAfalse
                                    104.26.13.205
                                    		api.ipify.orgUnited States
                                    		13335CLOUDFLARENETUSfalse

                                    General Information

                                    Joe Sandbox version:42.0.0 Malachite
                                    Analysis ID:1588132
                                    Start date and time:2025-01-10 21:38:57 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 7m 48s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:19
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:HGhGAjCVw5.exe
                                    renamed because original name is a hash value
                                    Original Sample Name:d4a4e4c891bacb6ffa8884695d7d757d8dbbae18ec64370bac3f6ecc024ea334.exe
                                    Detection:MAL
                                    Classification:mal100.troj.spyw.evad.winEXE@19/15@2/2
                                    EGA Information:
                                    • Successful, ratio: 100%
                                    HCA Information:
                                    • Successful, ratio: 98%
                                    • Number of executed functions: 152
                                    • Number of non-executed functions: 27
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.12.23.50, 13.107.246.45
                                    • Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size getting too big, too many NtCreateKey calls found.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    15:40:19API Interceptor190x Sleep call for process: HGhGAjCVw5.exe modified
                                    15:40:20API Interceptor45x Sleep call for process: powershell.exe modified
                                    15:40:24API Interceptor184x Sleep call for process: gdJhjh.exe modified
                                    21:40:21Task SchedulerRun new task: gdJhjh path: C:\Users\user\AppData\Roaming\gdJhjh.exe

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    46.175.148.580PPJsQE4wD.exeGet hashmaliciousAgentTeslaBrowse
                                      kzy8qg5lbR.exeGet hashmaliciousAgentTeslaBrowse
                                        OP53532 Harumi new order.scr.exeGet hashmaliciousAgentTeslaBrowse
                                          INV01542 , INV01562-7500003124 JTR-0084.exeGet hashmaliciousAgentTeslaBrowse
                                            Shipment Dec Orders valves 2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                              proforma invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                Overdue_payment.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                  PO for fabric forecast.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                    980001672 PPR for 30887217.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                      lC7L7oBBMC.exeGet hashmaliciousAgentTeslaBrowse
                                                        104.26.13.205Yoranis Setup.exeGet hashmaliciousUnknownBrowse
                                                        • api.ipify.org/
                                                        BiXS3FRoLe.exeGet hashmaliciousTrojanRansomBrowse
                                                        • api.ipify.org/
                                                        lEUy79aLAW.exeGet hashmaliciousTrojanRansomBrowse
                                                        • api.ipify.org/
                                                        Simple1.exeGet hashmaliciousUnknownBrowse
                                                        • api.ipify.org/
                                                        2b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                                                        • api.ipify.org/
                                                        file.exeGet hashmaliciousUnknownBrowse
                                                        • api.ipify.org/
                                                        file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                        • api.ipify.org/
                                                        file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                                        • api.ipify.org/
                                                        file.exeGet hashmaliciousRDPWrap ToolBrowse
                                                        • api.ipify.org/
                                                        Prismifyr-Install.exeGet hashmaliciousNode StealerBrowse
                                                        • api.ipify.org/

                                                        Domains

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        mail.iaa-airferight.com0PPJsQE4wD.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        kzy8qg5lbR.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        OP53532 Harumi new order.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        INV01542 , INV01562-7500003124 JTR-0084.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        Shipment Dec Orders valves 2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        proforma invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        Overdue_payment.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        PO for fabric forecast.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                        • 46.175.148.58
                                                        980001672 PPR for 30887217.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        lC7L7oBBMC.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        api.ipify.orghttps://glfbanks.com/Get hashmaliciousHTMLPhisherBrowse
                                                        • 104.26.12.205
                                                        s2Jg1MAahY.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 104.26.12.205
                                                        Y8Q1voljvb.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 104.26.12.205
                                                        IUqsn1SBGy.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 104.26.13.205
                                                        DpTbBYeE7J.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                        • 104.26.12.205
                                                        RJKUWSGxej.exeGet hashmaliciousAgentTesla, RedLineBrowse
                                                        • 104.26.13.205
                                                        7DpzcPcsTS.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 172.67.74.152
                                                        B8FnDUj8hy.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 104.26.13.205
                                                        FSRHC6mB16.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                        • 172.67.74.152
                                                        9pIm5d0rsW.exeGet hashmaliciousAgentTesla, PureLog Stealer, zgRATBrowse
                                                        • 104.26.13.205

                                                        ASNs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        ASLAGIDKOM-NETUA0PPJsQE4wD.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        kzy8qg5lbR.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        OP53532 Harumi new order.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        INV01542 , INV01562-7500003124 JTR-0084.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        Shipment Dec Orders valves 2024.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        proforma invoice.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        Overdue_payment.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        PO for fabric forecast.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                        • 46.175.148.58
                                                        980001672 PPR for 30887217.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        lC7L7oBBMC.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 46.175.148.58
                                                        CLOUDFLARENETUShttps://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8fGet hashmaliciousUnknownBrowse
                                                        • 104.17.25.14
                                                        https://cocteldedeas.mx/rx567#cmVjaWJhc2VAc2VhbWFyaXRpbWEuY29tGet hashmaliciousHTMLPhisherBrowse
                                                        • 188.114.96.3
                                                        NFhRxwbegd.exeGet hashmaliciousFormBookBrowse
                                                        • 104.21.80.1
                                                        4UQ5wnI389.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.21.112.1
                                                        http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                        • 188.114.96.3
                                                        ajRZflJ2ch.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.21.48.1
                                                        FUEvp5c8lO.exeGet hashmaliciousAsyncRAT, StormKitty, WorldWind StealerBrowse
                                                        • 104.16.184.241
                                                        http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                        • 104.17.25.14
                                                        hZbkP3TJBJ.exeGet hashmaliciousSnake KeyloggerBrowse
                                                        • 104.21.48.1
                                                        348426869538810128.jsGet hashmaliciousStrela DownloaderBrowse
                                                        • 162.159.61.3

                                                        JA3 Fingerprints

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        3b5074b1b5d032e5620f69f9f700ff0e4UQ5wnI389.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.26.13.205
                                                        ajRZflJ2ch.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.26.13.205
                                                        FUEvp5c8lO.exeGet hashmaliciousAsyncRAT, StormKitty, WorldWind StealerBrowse
                                                        • 104.26.13.205
                                                        http://diebinjmajbkhhg.top/1.php?s=527Get hashmaliciousUnknownBrowse
                                                        • 104.26.13.205
                                                        https://patiooutletmaipu.cl/tiendas/head/Get hashmaliciousLummaC, CAPTCHA Scam ClickFix, LummaC StealerBrowse
                                                        • 104.26.13.205
                                                        19d6P55zd1.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                        • 104.26.13.205
                                                        9L83v5j083.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                        • 104.26.13.205
                                                        y1jQC8Y6bP.exeGet hashmaliciousMassLogger RATBrowse
                                                        • 104.26.13.205
                                                        FILHKLtCw0.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.26.13.205
                                                        ppISxhDcpF.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                        • 104.26.13.205

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HGhGAjCVw5.exe.log

                                                        Download File
                                                        Process:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1216
                                                        Entropy (8bit):5.34331486778365
                                                        Encrypted:false
                                                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                        Malicious:true
                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gdJhjh.exe.log

                                                        Download File
                                                        Process:C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1216
                                                        Entropy (8bit):5.34331486778365
                                                        Encrypted:false
                                                        SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                        MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                        SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                        SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                        SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                        Malicious:false
                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:data
                                                        Category:modified
                                                        Size (bytes):2232
                                                        Entropy (8bit):5.380805901110357
                                                        Encrypted:false
                                                        SSDEEP:48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:lGLHyIFKL3IZ2KRH9Oug8s
                                                        MD5:16AD599332DD2FF94DA0787D71688B62
                                                        SHA1:02F738694B02E84FFE3BAB7DE5709001823C6E40
                                                        SHA-256:452876FE504FC0DBEDBD7F8467E94F6E80002DB4572D02C723ABC69F8DF0B367
                                                        SHA-512:A96158FDFFA424A4AC01220EDC789F3236C03AAA6A7C1A3D8BE62074B4923957E6CFEEB6E8852F9064093E0A290B0E56E4B5504D18113A7983F48D5388CEC747
                                                        Malicious:false
                                                        Preview:@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpb3sfrs.tx4.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrzqcvx2.aub.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kgvckkcd.vjk.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_la3fu512.os0.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lvbbwt2k.bzj.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_on2uzkq2.p0u.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qr2gdxfr.eqi.ps1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qyekkh0i.bjf.psm1

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\tmp57CE.tmp

                                                        Download File
                                                        Process:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        File Type:XML 1.0 document, ASCII text
                                                        Category:dropped
                                                        Size (bytes):1565
                                                        Entropy (8bit):5.110098175381362
                                                        Encrypted:false
                                                        SSDEEP:48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTsv:He7XQBBYrFdOFzOz6dKrsuO
                                                        MD5:093C3B37A8BB70FBF2D0924853DF7954
                                                        SHA1:6B0DE4FBAC59F5543D701BC3E7B408C424D6BC98
                                                        SHA-256:4F687B44380D99901AB19E140DC998431DB4A6001CCCF5E550F70F5265E296F6
                                                        SHA-512:E5D7C5C30C099C10D6449FE3326F1E9EDCEB9FE50878891211C69F3D78D491051910AA9CC0B19E5FBDE98C732A7DCFD717B630410D7E3E209001D02AC1F4AA21
                                                        Malicious:true
                                                        Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

                                                        C:\Users\user\AppData\Local\Temp\tmp6B66.tmp

                                                        Download File
                                                        Process:C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        File Type:XML 1.0 document, ASCII text
                                                        Category:dropped
                                                        Size (bytes):1565
                                                        Entropy (8bit):5.110098175381362
                                                        Encrypted:false
                                                        SSDEEP:48:cge7XQBBYrFdOFzOzN33ODOiDdKrsuTsv:He7XQBBYrFdOFzOz6dKrsuO
                                                        MD5:093C3B37A8BB70FBF2D0924853DF7954
                                                        SHA1:6B0DE4FBAC59F5543D701BC3E7B408C424D6BC98
                                                        SHA-256:4F687B44380D99901AB19E140DC998431DB4A6001CCCF5E550F70F5265E296F6
                                                        SHA-512:E5D7C5C30C099C10D6449FE3326F1E9EDCEB9FE50878891211C69F3D78D491051910AA9CC0B19E5FBDE98C732A7DCFD717B630410D7E3E209001D02AC1F4AA21
                                                        Malicious:false
                                                        Preview:<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvailable>f

                                                        C:\Users\user\AppData\Roaming\gdJhjh.exe

                                                        Download File
                                                        Process:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):986624
                                                        Entropy (8bit):7.461406357161058
                                                        Encrypted:false
                                                        SSDEEP:12288:EjlIpHtMPku+l0CPPPJAhajNglP1FmS+jxSCMz+5vET5TVw/AQgMQ60kzodR67Ls:EjlIhSPd+pTgl1wS+jv56bw2V6+eAF
                                                        MD5:4D77D26B50BEA6A8755808EB5BEC3044
                                                        SHA1:19383419C4A21E39C46852059AE240E8AB6CC12F
                                                        SHA-256:D4A4E4C891BACB6FFA8884695D7D757D8DBBAE18EC64370BAC3F6ECC024EA334
                                                        SHA-512:2064F545989E2936DEC55A7D894B4DC03AEFEBC112310E2E9797A130D4625CCEB709E3739876B82C90FE236E100F5B31768C73472E53B9835ED8B6BE77ECC521
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: Avira, Detection: 100%
                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                        • Antivirus: ReversingLabs, Detection: 71%
                                                        • Antivirus: Virustotal, Detection: 61%, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.Zg..............0..T...........r... ........@.. .......................`............@.................................Hr..O............................@....................................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc.......@......................@..B................|r......H.......d1... .......... R..( ...........................................0...........(........}.....s....}.....r...p(....}.....~.... ....s....}.....{....o.... ......o......{.....o......{....o.....{....o......{.....{....o.....*f........s....s....(.....*~..{....r...po......{....o.....*.0..}.........{....r9..po......+7...{.....|....o ...}....(!....{....o".....{.....o........+.&..{....rS..po........&..{....rS..po........*...........>P..........>f.........}.....(#.......s....}....

                                                        C:\Users\user\AppData\Roaming\gdJhjh.exe:Zone.Identifier

                                                        Download File
                                                        Process:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):26
                                                        Entropy (8bit):3.95006375643621
                                                        Encrypted:false
                                                        SSDEEP:3:ggPYV:rPYV
                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                        Malicious:true
                                                        Preview:[ZoneTransfer]....ZoneId=0

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Entropy (8bit):7.461406357161058
                                                        TrID:
                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                        • DOS Executable Generic (2002/1) 0.01%
                                                        File name:HGhGAjCVw5.exe
                                                        File size:986'624 bytes
                                                        MD5:4d77d26b50bea6a8755808eb5bec3044
                                                        SHA1:19383419c4a21e39c46852059ae240e8ab6cc12f
                                                        SHA256:d4a4e4c891bacb6ffa8884695d7d757d8dbbae18ec64370bac3f6ecc024ea334
                                                        SHA512:2064f545989e2936dec55a7d894b4dc03aefebc112310e2e9797a130d4625cceb709e3739876b82c90fe236e100f5b31768c73472e53b9835ed8b6be77ecc521
                                                        SSDEEP:12288:EjlIpHtMPku+l0CPPPJAhajNglP1FmS+jxSCMz+5vET5TVw/AQgMQ60kzodR67Ls:EjlIhSPd+pTgl1wS+jv56bw2V6+eAF
                                                        TLSH:C925F4C32A2DA672DE38A73C40159DF891B41D6C2088B5A65BF87F3EE57C0225D1FE19
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.Zg..............0..T...........r... ........@.. .......................`............@................................

                                                        File Icon

                                                        Icon Hash:2946e68e96b3ca4d

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x4c729a
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x675A854B [Thu Dec 12 06:40:11 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp dword ptr [00402000h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xc72480x4f.text
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xc80000x2b504.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xf40000xc.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x20000xc52a00xc5400ad16d395b8c0f8de862b96de60b5759dFalse0.8843732671894804data7.6842460602118505IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rsrc0xc80000x2b5040x2b600b1bafe6306af8a4c4a787e3cc23398f5False0.20849468659942363data5.118470322925119IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0xf40000xc0x2006999d2e0c3fd95254b190f50bdf454fdFalse0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_ICON0xc82980x3751PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9929383518113127
                                                        RT_ICON0xcb9ec0x10828Device independent bitmap graphic, 128 x 256 x 32, image size 675840.0891251626641429
                                                        RT_ICON0xdc2140x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 380160.13335610678999368
                                                        RT_ICON0xe56bc0x5488Device independent bitmap graphic, 72 x 144 x 32, image size 216000.16816081330868762
                                                        RT_ICON0xeab440x4228Device independent bitmap graphic, 64 x 128 x 32, image size 168960.15594000944733113
                                                        RT_ICON0xeed6c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.23392116182572614
                                                        RT_ICON0xf13140x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.274624765478424
                                                        RT_ICON0xf23bc0x988Device independent bitmap graphic, 24 x 48 x 32, image size 24000.41885245901639345
                                                        RT_ICON0xf2d440x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.5
                                                        RT_GROUP_ICON0xf31ac0x84data0.7045454545454546
                                                        RT_GROUP_ICON0xf32300x14data1.05
                                                        RT_VERSION0xf32440x2c0data0.4602272727272727

                                                        Imports

                                                        DLLImport
                                                        mscoree.dll_CorExeMain

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Jan 10, 2025 21:40:22.323254108 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:22.323302984 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:22.323532104 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:22.329847097 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:22.329864979 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.084063053 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.084269047 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:23.095752954 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:23.095773935 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.096079111 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.144391060 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:23.421547890 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:23.463326931 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.625230074 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.625302076 CET44349707104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:23.625416994 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:23.634704113 CET49707443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:24.688853025 CET4970825192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:25.691360950 CET4970825192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:26.755333900 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:26.755377054 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:26.755517006 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:26.759520054 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:26.759541035 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.348928928 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.349016905 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:27.350509882 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:27.350516081 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.350781918 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.404808044 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:27.447374105 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.577241898 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.577313900 CET44349711104.26.13.205192.168.2.10
                                                        Jan 10, 2025 21:40:27.577426910 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:27.583257914 CET49711443192.168.2.10104.26.13.205
                                                        Jan 10, 2025 21:40:27.785024881 CET4970825192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:28.127831936 CET4971225192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:29.128782034 CET4971225192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:31.128895044 CET4971225192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:31.785049915 CET4970825192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:35.128880024 CET4971225192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:39.785082102 CET4970825192.168.2.1046.175.148.58
                                                        Jan 10, 2025 21:40:43.128806114 CET4971225192.168.2.1046.175.148.58

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Jan 10, 2025 21:40:22.290512085 CET6467753192.168.2.101.1.1.1
                                                        Jan 10, 2025 21:40:22.297337055 CET53646771.1.1.1192.168.2.10
                                                        Jan 10, 2025 21:40:24.653084040 CET6275653192.168.2.101.1.1.1
                                                        Jan 10, 2025 21:40:24.687710047 CET53627561.1.1.1192.168.2.10

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Jan 10, 2025 21:40:22.290512085 CET192.168.2.101.1.1.10x2ff8Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false
                                                        Jan 10, 2025 21:40:24.653084040 CET192.168.2.101.1.1.10xe7cbStandard query (0)mail.iaa-airferight.comA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Jan 10, 2025 21:40:22.297337055 CET1.1.1.1192.168.2.100x2ff8No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false
                                                        Jan 10, 2025 21:40:22.297337055 CET1.1.1.1192.168.2.100x2ff8No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                        Jan 10, 2025 21:40:22.297337055 CET1.1.1.1192.168.2.100x2ff8No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                        Jan 10, 2025 21:40:24.687710047 CET1.1.1.1192.168.2.100xe7cbNo error (0)mail.iaa-airferight.com46.175.148.58A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • api.ipify.org

                                                        HTTPS Proxied Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.1049707104.26.13.2054437348C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        TimestampBytes transferredDirectionData
                                                        2025-01-10 20:40:23 UTC155OUTGET / HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
                                                        Host: api.ipify.org
                                                        Connection: Keep-Alive
                                                        2025-01-10 20:40:23 UTC427INHTTP/1.1 200 OK
                                                        Date: Fri, 10 Jan 2025 20:40:23 GMT
                                                        Content-Type: text/plain
                                                        Content-Length: 12
                                                        Connection: close
                                                        Vary: Origin
                                                        CF-Cache-Status: DYNAMIC
                                                        Server: cloudflare
                                                        CF-RAY: 8fff7b5b09b67ced-EWR
                                                        server-timing: cfL4;desc="?proto=TCP&rtt=64626&min_rtt=21717&rtt_var=35804&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=134456&cwnd=179&unsent_bytes=0&cid=64e79a11a18608c5&ts=557&x=0"
                                                        2025-01-10 20:40:23 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                        Data Ascii: 8.46.123.189


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.1049711104.26.13.2054437764C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        TimestampBytes transferredDirectionData
                                                        2025-01-10 20:40:27 UTC155OUTGET / HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
                                                        Host: api.ipify.org
                                                        Connection: Keep-Alive
                                                        2025-01-10 20:40:27 UTC424INHTTP/1.1 200 OK
                                                        Date: Fri, 10 Jan 2025 20:40:27 GMT
                                                        Content-Type: text/plain
                                                        Content-Length: 12
                                                        Connection: close
                                                        Vary: Origin
                                                        CF-Cache-Status: DYNAMIC
                                                        Server: cloudflare
                                                        CF-RAY: 8fff7b73ca914358-EWR
                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1745&rtt_var=783&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=769&delivery_rate=1290893&cwnd=206&unsent_bytes=0&cid=4adcc4d35d097ec2&ts=219&x=0"
                                                        2025-01-10 20:40:27 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                        Data Ascii: 8.46.123.189


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:15:40:18
                                                        Start date:10/01/2025
                                                        Path:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\HGhGAjCVw5.exe"
                                                        Imagebase:0xc50000
                                                        File size:986'624 bytes
                                                        MD5 hash:4D77D26B50BEA6A8755808EB5BEC3044
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1590826725.00000000040C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1590826725.0000000004934000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:3
                                                        Start time:15:40:19
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HGhGAjCVw5.exe"
                                                        Imagebase:0x3f0000
                                                        File size:433'152 bytes
                                                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff620390000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:5
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\gdJhjh.exe"
                                                        Imagebase:0x3f0000
                                                        File size:433'152 bytes
                                                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:6
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff620390000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:7
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp57CE.tmp"
                                                        Imagebase:0x420000
                                                        File size:187'904 bytes
                                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:8
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff620390000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:9
                                                        Start time:15:40:20
                                                        Start date:10/01/2025
                                                        Path:C:\Users\user\Desktop\HGhGAjCVw5.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\HGhGAjCVw5.exe"
                                                        Imagebase:0xa00000
                                                        File size:986'624 bytes
                                                        MD5 hash:4D77D26B50BEA6A8755808EB5BEC3044
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2822698121.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2822698121.00000000031F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2822698121.000000000321C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low
                                                        Has exited:false

                                                        General

                                                        Target ID:10
                                                        Start time:15:40:21
                                                        Start date:10/01/2025
                                                        Path:C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        Imagebase:0x970000
                                                        File size:986'624 bytes
                                                        MD5 hash:4D77D26B50BEA6A8755808EB5BEC3044
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Antivirus matches:
                                                        • Detection: 100%, Avira
                                                        • Detection: 100%, Joe Sandbox ML
                                                        • Detection: 71%, ReversingLabs
                                                        • Detection: 61%, Virustotal, Browse
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:11
                                                        Start time:15:40:23
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                        Imagebase:0x7ff6616b0000
                                                        File size:496'640 bytes
                                                        MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                        Has elevated privileges:true
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:12
                                                        Start time:15:40:25
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gdJhjh" /XML "C:\Users\user\AppData\Local\Temp\tmp6B66.tmp"
                                                        Imagebase:0x420000
                                                        File size:187'904 bytes
                                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:13
                                                        Start time:15:40:25
                                                        Start date:10/01/2025
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff620390000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Has exited:true

                                                        General

                                                        Target ID:14
                                                        Start time:15:40:25
                                                        Start date:10/01/2025
                                                        Path:C:\Users\user\AppData\Roaming\gdJhjh.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\AppData\Roaming\gdJhjh.exe"
                                                        Imagebase:0xce0000
                                                        File size:986'624 bytes
                                                        MD5 hash:4D77D26B50BEA6A8755808EB5BEC3044
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2821075648.000000000313C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2821075648.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.2818045057.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                        Has exited:false

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:10%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:0%
                                                          Total number of Nodes:55
                                                          Total number of Limit Nodes:8
                                                          execution_graph 22519 2eb4668 22520 2eb467a 22519->22520 22521 2eb4686 22520->22521 22523 2eb4779 22520->22523 22524 2eb479d 22523->22524 22528 2eb4888 22524->22528 22532 2eb4878 22524->22532 22530 2eb48af 22528->22530 22529 2eb498c 22529->22529 22530->22529 22536 2eb44b0 22530->22536 22534 2eb48af 22532->22534 22533 2eb498c 22533->22533 22534->22533 22535 2eb44b0 CreateActCtxA 22534->22535 22535->22533 22537 2eb5918 CreateActCtxA 22536->22537 22539 2eb59cf 22537->22539 22565 2ebd4d8 22566 2ebd51e GetCurrentProcess 22565->22566 22568 2ebd569 22566->22568 22569 2ebd570 GetCurrentThread 22566->22569 22568->22569 22570 2ebd5ad GetCurrentProcess 22569->22570 22571 2ebd5a6 22569->22571 22572 2ebd5e3 22570->22572 22571->22570 22573 2ebd60b GetCurrentThreadId 22572->22573 22574 2ebd63c 22573->22574 22575 77266c1 22576 77266c4 22575->22576 22577 7726729 22576->22577 22578 7727cc0 VirtualProtect 22576->22578 22579 7727cb8 VirtualProtect 22576->22579 22578->22576 22579->22576 22540 7726036 22544 7727cc0 22540->22544 22547 7727cb8 22540->22547 22541 772604d 22545 7727d08 VirtualProtect 22544->22545 22546 7727d42 22545->22546 22546->22541 22548 7727cc0 VirtualProtect 22547->22548 22550 7727d42 22548->22550 22550->22541 22551 77259b4 22553 7727cc0 VirtualProtect 22551->22553 22554 7727cb8 VirtualProtect 22551->22554 22552 77259e5 22553->22552 22554->22552 22555 2ebd720 DuplicateHandle 22556 2ebd7b6 22555->22556 22588 2ebad50 22589 2ebad5f 22588->22589 22592 2ebae48 22588->22592 22597 2ebae37 22588->22597 22593 2ebae59 22592->22593 22594 2ebae7c 22592->22594 22593->22594 22595 2ebb080 GetModuleHandleW 22593->22595 22594->22589 22596 2ebb0ad 22595->22596 22596->22589 22598 2ebae7c 22597->22598 22599 2ebae59 22597->22599 22598->22589 22599->22598 22600 2ebb080 GetModuleHandleW 22599->22600 22601 2ebb0ad 22600->22601 22601->22589

                                                          Executed Functions

                                                          Function 07722C8B Relevance: 4.1, Strings: 3, Instructions: 339COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 44 7722c8b-7722c8e 45 7722c90-7722c92 44->45 46 7722c97-7722c98 44->46 45->46 47 7722c9b-7722ca0 45->47 46->47 48 7722ca2 47->48 49 7722cc4-7722cc6 47->49 50 7722ca4-7722ca6 48->50 51 7722cab 48->51 52 7722cc7-7722cca 49->52 53 7722ccf-7722cd0 49->53 55 7722ca8-7722caa 50->55 56 7722caf-7722cb0 50->56 51->56 54 7722cd3-7722cd6 52->54 57 7722ccb-7722ccc 52->57 53->54 60 7722cd7-7722cdd 54->60 61 7722cdf-7722cee 54->61 55->51 62 7722cb3-7722cb6 55->62 56->62 58 7722cce 57->58 59 7722cef-7722d1d 57->59 58->53 58->60 66 7722d24-7722d62 call 77232a0 59->66 67 7722d1f 59->67 60->61 61->59 64 7722cb8-7722cba 62->64 65 7722cbf-7722cc2 62->65 68 7722cc3 64->68 69 7722cbc-7722cbe 64->69 65->57 65->68 71 7722d68 66->71 67->66 68->49 69->52 69->65 72 7722d6f-7722d8b 71->72 73 7722d94-7722d95 72->73 74 7722d8d 72->74 90 77230eb-77230f2 73->90 74->71 74->73 75 7722f73-7722f88 74->75 76 7722e10-7722e28 74->76 77 7722d9a-7722d9e 74->77 78 7722ddb-7722de4 74->78 79 772307b-77230a0 74->79 80 7722fbd-7722fc1 74->80 81 7722e7d-7722e9b 74->81 82 7722ea0-7722eac 74->82 83 7722f61-7722f6e 74->83 84 7722f06-7722f26 74->84 85 7722e66-7722e78 74->85 86 7722f47-7722f5c 74->86 87 7722dc7-7722dd9 74->87 88 77230a5-77230b1 74->88 89 7722eca-7722eea 74->89 74->90 91 7722f2b-7722f42 74->91 92 7722eef-7722f01 74->92 93 77230cf-77230e6 74->93 94 7722f8d-7722f91 74->94 95 7722fed-7722ff9 74->95 75->72 96 7722e2a 76->96 97 7722e2f-7722e45 76->97 108 7722da0-7722daf 77->108 109 7722db1-7722db8 77->109 110 7722de6-7722df5 78->110 111 7722df7-7722dfe 78->111 79->72 102 7722fc3-7722fd2 80->102 103 7722fd4-7722fdb 80->103 81->72 106 7722eb3-7722ec5 82->106 107 7722eae 82->107 83->72 84->72 85->72 86->72 87->72 98 77230b3 88->98 99 77230b8-77230ca 88->99 89->72 91->72 92->72 93->72 100 7722f93-7722fa2 94->100 101 7722fa4-7722fab 94->101 104 7723000-7723016 95->104 105 7722ffb 95->105 96->97 124 7722e47 97->124 125 7722e4c-7722e61 97->125 98->99 99->72 114 7722fb2-7722fb8 100->114 101->114 115 7722fe2-7722fe8 102->115 103->115 126 7723018 104->126 127 772301d-7723033 104->127 105->104 106->72 107->106 118 7722dbf-7722dc5 108->118 109->118 112 7722e05-7722e0b 110->112 111->112 112->72 114->72 115->72 118->72 124->125 125->72 126->127 130 7723035 127->130 131 772303a-7723050 127->131 130->131 133 7723052 131->133 134 7723057-7723076 131->134 133->134 134->72
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ry$ry$ry
                                                          • API String ID: 0-128149707
                                                          • Opcode ID: 2886ce9dea797879214900865f29b7cdb8359aba846156c9222772c15aa18b79
                                                          • Instruction ID: a21815463e2475846e1af88cca2a9cbe420ef796cc3860d346967acb4cdedaf1
                                                          • Opcode Fuzzy Hash: 2886ce9dea797879214900865f29b7cdb8359aba846156c9222772c15aa18b79
                                                          • Instruction Fuzzy Hash: 86D1CFB1D04626DFCB14CFA5D4844AEFBB2FF8A340B15855AD422AB216C734DA83DF94
                                                          Function 07722CF8 Relevance: 4.0, Strings: 3, Instructions: 284COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 137 7722cf8-7722d1d 138 7722d24-7722d62 call 77232a0 137->138 139 7722d1f 137->139 141 7722d68 138->141 139->138 142 7722d6f-7722d8b 141->142 143 7722d94-7722d95 142->143 144 7722d8d 142->144 160 77230eb-77230f2 143->160 144->141 144->143 145 7722f73-7722f88 144->145 146 7722e10-7722e28 144->146 147 7722d9a-7722d9e 144->147 148 7722ddb-7722de4 144->148 149 772307b-77230a0 144->149 150 7722fbd-7722fc1 144->150 151 7722e7d-7722e9b 144->151 152 7722ea0-7722eac 144->152 153 7722f61-7722f6e 144->153 154 7722f06-7722f26 144->154 155 7722e66-7722e78 144->155 156 7722f47-7722f5c 144->156 157 7722dc7-7722dd9 144->157 158 77230a5-77230b1 144->158 159 7722eca-7722eea 144->159 144->160 161 7722f2b-7722f42 144->161 162 7722eef-7722f01 144->162 163 77230cf-77230e6 144->163 164 7722f8d-7722f91 144->164 165 7722fed-7722ff9 144->165 145->142 166 7722e2a 146->166 167 7722e2f-7722e45 146->167 178 7722da0-7722daf 147->178 179 7722db1-7722db8 147->179 180 7722de6-7722df5 148->180 181 7722df7-7722dfe 148->181 149->142 172 7722fc3-7722fd2 150->172 173 7722fd4-7722fdb 150->173 151->142 176 7722eb3-7722ec5 152->176 177 7722eae 152->177 153->142 154->142 155->142 156->142 157->142 168 77230b3 158->168 169 77230b8-77230ca 158->169 159->142 161->142 162->142 163->142 170 7722f93-7722fa2 164->170 171 7722fa4-7722fab 164->171 174 7723000-7723016 165->174 175 7722ffb 165->175 166->167 194 7722e47 167->194 195 7722e4c-7722e61 167->195 168->169 169->142 184 7722fb2-7722fb8 170->184 171->184 185 7722fe2-7722fe8 172->185 173->185 196 7723018 174->196 197 772301d-7723033 174->197 175->174 176->142 177->176 188 7722dbf-7722dc5 178->188 179->188 182 7722e05-7722e0b 180->182 181->182 182->142 184->142 185->142 188->142 194->195 195->142 196->197 200 7723035 197->200 201 772303a-7723050 197->201 200->201 203 7723052 201->203 204 7723057-7723076 201->204 203->204 204->142
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ry$ry$ry
                                                          • API String ID: 0-128149707
                                                          • Opcode ID: 93a971eb8b2ceb50637042de12faa2a89394bf1713ef8ffa5b5d8f788c7e2263
                                                          • Instruction ID: 9cd1946c56e639375dbdf1a0a65c48b2f68b85362461e3e8ea3bc4098ec046e6
                                                          • Opcode Fuzzy Hash: 93a971eb8b2ceb50637042de12faa2a89394bf1713ef8ffa5b5d8f788c7e2263
                                                          • Instruction Fuzzy Hash: F4C16AB0D1461ADFCB14CFA5D4858AEFBB2FF89340F11945AD422AB219D734EA42CF94
                                                          Function 077296C8 Relevance: 2.7, Strings: 2, Instructions: 224COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 207 77296c8-77296ed 208 77296f4-7729725 207->208 209 77296ef 207->209 210 7729726 208->210 209->208 211 772972d-7729749 210->211 212 7729752-7729753 211->212 213 772974b 211->213 214 7729758-772979a 212->214 215 77299bf-77299c8 212->215 213->210 213->214 213->215 216 7729972-7729984 213->216 217 77298d3-77298fa 213->217 218 7729893-77298a6 213->218 219 77297f7-77297fd call 7729b08 213->219 220 77297b4-77297db 213->220 221 772995b-772996d 213->221 222 772993e-7729956 213->222 223 77298ff-7729912 213->223 224 772985c-7729860 213->224 225 772979c-77297af 213->225 226 77297e0-77297f2 213->226 227 7729844-7729857 213->227 228 77298c5-77298ce 213->228 229 77299a5-77299ba 213->229 230 77298ab-77298c0 213->230 231 7729828-772983f 213->231 232 7729989-77299a0 213->232 214->211 216->211 217->211 218->211 242 7729803-7729823 219->242 220->211 221->211 222->211 233 7729914-7729923 223->233 234 7729925-772992c 223->234 235 7729862-7729871 224->235 236 7729873-772987a 224->236 225->211 226->211 227->211 228->211 229->211 230->211 231->211 232->211 238 7729933-7729939 233->238 234->238 241 7729881-772988e 235->241 236->241 238->211 241->211 242->211
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: TuA$UC;"
                                                          • API String ID: 0-2071649361
                                                          • Opcode ID: d5cba173b6161c21954de2e7a6ebab78077adc06f6b9004a2a19ba674001f540
                                                          • Instruction ID: 6bf72588744c5be59f99ce7ca6d49ffd10be85bcbd81848ca35eb168ba3f205b
                                                          • Opcode Fuzzy Hash: d5cba173b6161c21954de2e7a6ebab78077adc06f6b9004a2a19ba674001f540
                                                          • Instruction Fuzzy Hash: DF9129B4D24219DFCB08CFA5E5815DEFBB2EF89350F14A42AE525BB264D730A542DF40
                                                          Function 077296C6 Relevance: 2.7, Strings: 2, Instructions: 217COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 245 77296c6-77296ed 246 77296f4-7729725 245->246 247 77296ef 245->247 248 7729726 246->248 247->246 249 772972d-7729749 248->249 250 7729752-7729753 249->250 251 772974b 249->251 252 7729758-772979a 250->252 253 77299bf-77299c8 250->253 251->248 251->252 251->253 254 7729972-7729984 251->254 255 77298d3-77298fa 251->255 256 7729893-77298a6 251->256 257 77297f7-77297fd call 7729b08 251->257 258 77297b4-77297db 251->258 259 772995b-772996d 251->259 260 772993e-7729956 251->260 261 77298ff-7729912 251->261 262 772985c-7729860 251->262 263 772979c-77297af 251->263 264 77297e0-77297f2 251->264 265 7729844-7729857 251->265 266 77298c5-77298ce 251->266 267 77299a5-77299ba 251->267 268 77298ab-77298c0 251->268 269 7729828-772983f 251->269 270 7729989-77299a0 251->270 252->249 254->249 255->249 256->249 280 7729803-7729823 257->280 258->249 259->249 260->249 271 7729914-7729923 261->271 272 7729925-772992c 261->272 273 7729862-7729871 262->273 274 7729873-772987a 262->274 263->249 264->249 265->249 266->249 267->249 268->249 269->249 270->249 276 7729933-7729939 271->276 272->276 279 7729881-772988e 273->279 274->279 276->249 279->249 280->249
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: TuA$UC;"
                                                          • API String ID: 0-2071649361
                                                          • Opcode ID: 50dd018d16264eea9a9bfc8f6e447836a35d48973567253e7119af89bf29b789
                                                          • Instruction ID: a322b8bfe7522514e2bbf6b0b1754c107778fe279acf33715b2efbf7416a99a0
                                                          • Opcode Fuzzy Hash: 50dd018d16264eea9a9bfc8f6e447836a35d48973567253e7119af89bf29b789
                                                          • Instruction Fuzzy Hash: 7B9119B4D24219DFCB08CFA5E5815DEFBB2EF89390F14A42AE525B7264D730A542DF40
                                                          Function 07720AF7 Relevance: 1.5, Strings: 1, Instructions: 289COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 412 7720af7-7720b0a 413 7720b13-7720b16 412->413 414 7720b0c-7720b12 412->414 416 7720b18-7720b1a 413->416 417 7720b1f-7720b20 413->417 414->413 415 7720b1b-7720b1e 414->415 415->417 419 7720b27-7720b2e 415->419 416->415 418 7720b23-7720b26 416->418 417->418 418->419 420 7720b2f-7720b35 418->420 419->420 421 7720b37-7720b3a 419->421 420->421 422 7720b43-7720bb3 421->422 423 7720b3c 421->423 430 7720bb5 422->430 431 7720bba-7720c14 422->431 423->422 430->431 434 7720c17 431->434 435 7720c1e-7720c3a 434->435 436 7720c43-7720c44 435->436 437 7720c3c 435->437 441 7720df0-7720e60 436->441 447 7720c49-7720c71 436->447 437->434 438 7720d93-7720dae 437->438 439 7720c73-7720c85 437->439 440 7720db3-7720dca 437->440 437->441 442 7720cdc-7720d06 437->442 443 7720d60-7720d6d 437->443 444 7720d46-7720d5b 437->444 445 7720c87-7720ca7 437->445 446 7720d0b-7720d41 437->446 437->447 448 7720dcf-7720deb 437->448 449 7720cac-7720cb0 437->449 438->435 439->435 440->435 465 7720e62 call 7722766 441->465 466 7720e62 call 7722b37 441->466 467 7720e62 call 7721e7a 441->467 468 7720e62 call 772214b 441->468 469 7720e62 call 7722ae8 441->469 442->435 460 7720d76-7720d8e 443->460 444->435 445->435 446->435 447->435 448->435 450 7720cb2-7720cc1 449->450 451 7720cc3-7720cca 449->451 453 7720cd1-7720cd7 450->453 451->453 453->435 460->435 464 7720e68-7720e72 465->464 466->464 467->464 468->464 469->464
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: z^I
                                                          • API String ID: 0-307258731
                                                          • Opcode ID: 88c2f8dcf3d24bc6ffcb97f7e0d3d3d464cfb7631b54b5d6e4e2fd4b98ae72df
                                                          • Instruction ID: 8930a8c7a418ea6ffd4d11b1f867e1f43820bf69d987f6f33c5f425e2d23afdf
                                                          • Opcode Fuzzy Hash: 88c2f8dcf3d24bc6ffcb97f7e0d3d3d464cfb7631b54b5d6e4e2fd4b98ae72df
                                                          • Instruction Fuzzy Hash: 50B16CB5E002598FCB04CFA9C8846DDFBB2FF89350F14912AD425AB365D7349982CF64
                                                          Function 07720B3F Relevance: 1.5, Strings: 1, Instructions: 248COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: z^I
                                                          • API String ID: 0-307258731
                                                          • Opcode ID: 4646d36891b411a7c2103aa7dc54f93f6383eec6d8b9043cf248dcc17e05a5e1
                                                          • Instruction ID: eb8df7fa3d24a5a49900e92c99f908affdd36e65d0a4df43496224167d8d3877
                                                          • Opcode Fuzzy Hash: 4646d36891b411a7c2103aa7dc54f93f6383eec6d8b9043cf248dcc17e05a5e1
                                                          • Instruction Fuzzy Hash: A6A128B5E102198FCB08CFA9C8846DEFBB2FF89310F14902AD415AB364D7349982CF64
                                                          Function 07720B77 Relevance: 1.5, Strings: 1, Instructions: 228COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: z^I
                                                          • API String ID: 0-307258731
                                                          • Opcode ID: 4a1a322f2949e87b506c4db4810fd1567401cf987792bc0b983b3fa9db75ca28
                                                          • Instruction ID: 541f92dcfdef79ac3003bfded57c3752aec1ae1e4b47930d9d7068c7d6d8470b
                                                          • Opcode Fuzzy Hash: 4a1a322f2949e87b506c4db4810fd1567401cf987792bc0b983b3fa9db75ca28
                                                          • Instruction Fuzzy Hash: E4A1E5B4E142199FCB04CFAAC9446DDFBB2EF89300F14902AD415AB364D7749946CF64
                                                          Function 07720B90 Relevance: 1.5, Strings: 1, Instructions: 219COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: z^I
                                                          • API String ID: 0-307258731
                                                          • Opcode ID: 02037fd7059c3ee7756ac4396a91e53e9417d9fc04ed62eafc1d0a59b9dda50e
                                                          • Instruction ID: 4223e3fdf96d09f1bdb9392f11c7ad655a89db3a5482d1902cfe350d9d827f54
                                                          • Opcode Fuzzy Hash: 02037fd7059c3ee7756ac4396a91e53e9417d9fc04ed62eafc1d0a59b9dda50e
                                                          • Instruction Fuzzy Hash: 4891B3B4E102199FDB08CFAAC9846DDFBB2EF89300F24942AD415BB364D7749946CF64
                                                          Function 07728090 Relevance: 1.4, Strings: 1, Instructions: 181COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 5=6
                                                          • API String ID: 0-2897083178
                                                          • Opcode ID: 75b3c95f9ee7da7562201830861aee02211adaf89f2458bd9e7713aecba7a8d5
                                                          • Instruction ID: 7c9d4db8cc6d83e701f76a9688158b20e2475090d8bf5be3da9e15b5547e688e
                                                          • Opcode Fuzzy Hash: 75b3c95f9ee7da7562201830861aee02211adaf89f2458bd9e7713aecba7a8d5
                                                          • Instruction Fuzzy Hash: D77149B4E1521A9FCB08CFA6D8414AEFBF2FF8A240F00D46AD026E7254D7349A019F51
                                                          Function 077280A0 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 5=6
                                                          • API String ID: 0-2897083178
                                                          • Opcode ID: c3b5b8d127079eeb6f1c2300a75aba4164832e10c0fbc1caf9d7a613383f8406
                                                          • Instruction ID: c4cb4d7ea6cbcb4948b21534435784959133af5c5a23fcbd01017a28c4b914ad
                                                          • Opcode Fuzzy Hash: c3b5b8d127079eeb6f1c2300a75aba4164832e10c0fbc1caf9d7a613383f8406
                                                          • Instruction Fuzzy Hash: A8614AB4E1521ADFCB08CFA5D8414AEFBF2FF8A240F00E46AD026E7254D7349A019F55
                                                          Function 07721E7A Relevance: .1, Instructions: 77COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9a5ecea53d62fe5d82bef2536bef700140e3e1f780f7cd2b5bb2f19892416f09
                                                          • Instruction ID: 2008400797a4c4192ce58d3cdd7a3f39d59ec4a16fe8682d635660c4fb97e9fe
                                                          • Opcode Fuzzy Hash: 9a5ecea53d62fe5d82bef2536bef700140e3e1f780f7cd2b5bb2f19892416f09
                                                          • Instruction Fuzzy Hash: DF3127B1E016588FDB18CFA6D8502DEBBB2BFC9350F14C06AD809AA264DB345A46CF50
                                                          Function 02EBD4C9 Relevance: 6.1, APIs: 4, Instructions: 130threadCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentProcess.KERNEL32 ref: 02EBD556
                                                          • GetCurrentThread.KERNEL32 ref: 02EBD593
                                                          • GetCurrentProcess.KERNEL32 ref: 02EBD5D0
                                                          • GetCurrentThreadId.KERNEL32 ref: 02EBD629
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Current$ProcessThread
                                                          • String ID:
                                                          • API String ID: 2063062207-0
                                                          • Opcode ID: 0c58a929fa6b1f80b193144bff9c9e5f6ec3d3be84b0ada5cfbce77ef74c188e
                                                          • Instruction ID: 3dd01c75289c44c09a206d37c077c97ec2cde9f1114d4a57ccfba3825224f68e
                                                          • Opcode Fuzzy Hash: 0c58a929fa6b1f80b193144bff9c9e5f6ec3d3be84b0ada5cfbce77ef74c188e
                                                          • Instruction Fuzzy Hash: D15155B09013498FDB15CFA9D949BDEBBF1FF88308F208459E019A7250DB789985CF65
                                                          Function 02EBD4D8 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentProcess.KERNEL32 ref: 02EBD556
                                                          • GetCurrentThread.KERNEL32 ref: 02EBD593
                                                          • GetCurrentProcess.KERNEL32 ref: 02EBD5D0
                                                          • GetCurrentThreadId.KERNEL32 ref: 02EBD629
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Current$ProcessThread
                                                          • String ID:
                                                          • API String ID: 2063062207-0
                                                          • Opcode ID: fe4a30edd666931e7ee35817ed7304c760f8b2b7f4cc4748f2c8dbb9c4433377
                                                          • Instruction ID: af4b07d9336a5dd3e567c72ce57c225e068d3fe94f4bbf435b3337cb3d5492be
                                                          • Opcode Fuzzy Hash: fe4a30edd666931e7ee35817ed7304c760f8b2b7f4cc4748f2c8dbb9c4433377
                                                          • Instruction Fuzzy Hash: 125165B09012488FDB14DFAAD949BDEBBF1FF88308F208459E019A7350DB789985CF65
                                                          Function 02EBAE48 Relevance: 1.7, APIs: 1, Instructions: 196COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 283 2ebae48-2ebae57 284 2ebae59-2ebae66 call 2eba1a0 283->284 285 2ebae83-2ebae87 283->285 292 2ebae68 284->292 293 2ebae7c 284->293 286 2ebae9b-2ebaedc 285->286 287 2ebae89-2ebae93 285->287 294 2ebaee9-2ebaef7 286->294 295 2ebaede-2ebaee6 286->295 287->286 338 2ebae6e call 2ebb0d1 292->338 339 2ebae6e call 2ebb0e0 292->339 293->285 297 2ebaf1b-2ebaf1d 294->297 298 2ebaef9-2ebaefe 294->298 295->294 296 2ebae74-2ebae76 296->293 299 2ebafb8-2ebb078 296->299 300 2ebaf20-2ebaf27 297->300 301 2ebaf09 298->301 302 2ebaf00-2ebaf07 call 2eba1ac 298->302 333 2ebb07a-2ebb07d 299->333 334 2ebb080-2ebb0ab GetModuleHandleW 299->334 304 2ebaf29-2ebaf31 300->304 305 2ebaf34-2ebaf3b 300->305 303 2ebaf0b-2ebaf19 301->303 302->303 303->300 304->305 308 2ebaf48-2ebaf51 call 2eba1bc 305->308 309 2ebaf3d-2ebaf45 305->309 314 2ebaf5e-2ebaf63 308->314 315 2ebaf53-2ebaf5b 308->315 309->308 316 2ebaf81-2ebaf8e 314->316 317 2ebaf65-2ebaf6c 314->317 315->314 324 2ebafb1-2ebafb7 316->324 325 2ebaf90-2ebafae 316->325 317->316 319 2ebaf6e-2ebaf7e call 2eba1cc call 2eba1dc 317->319 319->316 325->324 333->334 335 2ebb0ad-2ebb0b3 334->335 336 2ebb0b4-2ebb0c8 334->336 335->336 338->296 339->296
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 02EBB09E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: a2e1a200f2682f237fc44c57ff8197ce583eef62bbd6ede36e3ccd0197a94469
                                                          • Instruction ID: 3c6c9ae6ae0a8e195cae9a44f333741a3f3a5aede589513c65b1964a00bb22b3
                                                          • Opcode Fuzzy Hash: a2e1a200f2682f237fc44c57ff8197ce583eef62bbd6ede36e3ccd0197a94469
                                                          • Instruction Fuzzy Hash: B97123B0A00B058FDB25DF2AD44479BBBF2BF48208F00892DE49A97B50DB75E845CF91
                                                          Function 02EB44B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 340 2eb44b0-2eb59d9 CreateActCtxA 343 2eb59db-2eb59e1 340->343 344 2eb59e2-2eb5a3c 340->344 343->344 351 2eb5a4b-2eb5a4f 344->351 352 2eb5a3e-2eb5a41 344->352 353 2eb5a51-2eb5a5d 351->353 354 2eb5a60-2eb5a90 351->354 352->351 353->354 358 2eb5a42-2eb5a4a 354->358 359 2eb5a92-2eb5b14 354->359 358->351 362 2eb59cf-2eb59d9 358->362 362->343 362->344
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 02EB59C9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID:
                                                          • API String ID: 2289755597-0
                                                          • Opcode ID: f03090f2c8250b0e5097ef2d658dd5645c8d58df4709d14306bc8e0022ed32c6
                                                          • Instruction ID: 4328bcf1adb35a9882dcd6168416e0f7aa90916a57846fe9227e6653cfd2a65e
                                                          • Opcode Fuzzy Hash: f03090f2c8250b0e5097ef2d658dd5645c8d58df4709d14306bc8e0022ed32c6
                                                          • Instruction Fuzzy Hash: 9841C2B0C00719CBEB25DFA9C884BDEBBF5BF49304F60805AD409AB251DB756946CF90
                                                          Function 02EB590D Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 363 2eb590d-2eb59d9 CreateActCtxA 365 2eb59db-2eb59e1 363->365 366 2eb59e2-2eb5a3c 363->366 365->366 373 2eb5a4b-2eb5a4f 366->373 374 2eb5a3e-2eb5a41 366->374 375 2eb5a51-2eb5a5d 373->375 376 2eb5a60-2eb5a90 373->376 374->373 375->376 380 2eb5a42-2eb5a4a 376->380 381 2eb5a92-2eb5b14 376->381 380->373 384 2eb59cf-2eb59d9 380->384 384->365 384->366
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 02EB59C9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID:
                                                          • API String ID: 2289755597-0
                                                          • Opcode ID: 32ad212a750f867dff0b359244edce2a34f1c1ecdf3e1a9a5a0d10fd41742a63
                                                          • Instruction ID: afb2b3657841281611f83630f25f0f07ea6a274bd6e13717f5441b365a662586
                                                          • Opcode Fuzzy Hash: 32ad212a750f867dff0b359244edce2a34f1c1ecdf3e1a9a5a0d10fd41742a63
                                                          • Instruction Fuzzy Hash: 1E41C1B0C00719CBEB25CFA9C8847DEBBF1BF49304F60805AD408AB251DB75694ACF90
                                                          Function 02EBD720 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 390 2ebd720-2ebd7b4 DuplicateHandle 391 2ebd7bd-2ebd7da 390->391 392 2ebd7b6-2ebd7bc 390->392 392->391
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EBD7A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: ae89cef8bd6f4d0935b33c0353cb1da594874ac5e6c3420aec625a3d0db4ec34
                                                          • Instruction ID: 1af1d251a609d7366ed738b64f495f70171cb2417d0a7c85740969146f8c7ee5
                                                          • Opcode Fuzzy Hash: ae89cef8bd6f4d0935b33c0353cb1da594874ac5e6c3420aec625a3d0db4ec34
                                                          • Instruction Fuzzy Hash: 1121E2B59002489FDB10CFAAD984ADEBBF8FB48310F14841AE918A3310D378A940CFA0
                                                          Function 02EBD719 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 385 2ebd719-2ebd7b4 DuplicateHandle 386 2ebd7bd-2ebd7da 385->386 387 2ebd7b6-2ebd7bc 385->387 387->386
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02EBD7A7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: 1855460e9388077913be8beca86b406754ff308ce1f750a0748e40a363decb80
                                                          • Instruction ID: a337f15996066cdaa99b56fad4f13ec026b31bd1d586137c97bc74b36e9750f9
                                                          • Opcode Fuzzy Hash: 1855460e9388077913be8beca86b406754ff308ce1f750a0748e40a363decb80
                                                          • Instruction Fuzzy Hash: 0A21E0B5D002189FDB10CFAAD985AEEBBF4FF48314F14841AE918B3210D378A940CFA0
                                                          Function 07727CB8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 395 7727cb8-7727d40 VirtualProtect 398 7727d42-7727d48 395->398 399 7727d49-7727d6a 395->399 398->399
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(?,?,?,?), ref: 07727D33
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 61315833a348d52e8c6e76d119d5a8f1377063e91fdc4e8d3c3aa749fd513184
                                                          • Instruction ID: c032767fab8578cd86f843eca90b43bba10c4c2f251cd6042f742d1e053aa189
                                                          • Opcode Fuzzy Hash: 61315833a348d52e8c6e76d119d5a8f1377063e91fdc4e8d3c3aa749fd513184
                                                          • Instruction Fuzzy Hash: 862106B5D002599FCB20DF9AC584BDEFBF4FB48310F10842AE968A7650D378A545CFA5
                                                          Function 07727CC0 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 401 7727cc0-7727d40 VirtualProtect 403 7727d42-7727d48 401->403 404 7727d49-7727d6a 401->404 403->404
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(?,?,?,?), ref: 07727D33
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: e822ec2fa24f1b5b82d0577cca58ac54c4621df05bf17cd1229116f8082a2bd9
                                                          • Instruction ID: 2cdf404dae7e50223c3a45ee92cb6cd0ac5c5c0da2204330fb4bb19ce5fcb323
                                                          • Opcode Fuzzy Hash: e822ec2fa24f1b5b82d0577cca58ac54c4621df05bf17cd1229116f8082a2bd9
                                                          • Instruction Fuzzy Hash: 0E21E4B5D002599FDB20DF9AC585BDEFBF4FB48320F108429E968A7250D378A945CFA1
                                                          Function 02EBB038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 406 2ebb038-2ebb078 407 2ebb07a-2ebb07d 406->407 408 2ebb080-2ebb0ab GetModuleHandleW 406->408 407->408 409 2ebb0ad-2ebb0b3 408->409 410 2ebb0b4-2ebb0c8 408->410 409->410
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 02EBB09E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: 170bb4e1ef45febb513c7cd5ef290fd13de9565f813fb1bea4f31389a27682ae
                                                          • Instruction ID: 9acd1465ee07c4f33a11ce0f532d26de36c81b45aa63d70df4484f5aa3ca8bbd
                                                          • Opcode Fuzzy Hash: 170bb4e1ef45febb513c7cd5ef290fd13de9565f813fb1bea4f31389a27682ae
                                                          • Instruction Fuzzy Hash: 6811DFB5D006498FDB20DF9AC444BDFFBF4EF88218F10845AD829A7610D379A545CFA1
                                                          Function 02DDD1FC Relevance: .1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 01d7ddb7aa06fa4580f7ad46a26d6c176b3c4613086de1ebe1f0d5d29afaeb36
                                                          • Instruction ID: 6610c7e22aacf9646bc66cd06e85f4ffce3e6c9f0fcf22dc3325b463bffac5fd
                                                          • Opcode Fuzzy Hash: 01d7ddb7aa06fa4580f7ad46a26d6c176b3c4613086de1ebe1f0d5d29afaeb36
                                                          • Instruction Fuzzy Hash: 0F21FF72504640EFDF05DF50D8C0F2ABF66FB88210F20C5A9E8490B346C33AE816CBA2
                                                          Function 02DDD3D8 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b856a6c3ddb8265ddbab391a547f29f04b95ec63c13d1469ac7007ed99c0b34b
                                                          • Instruction ID: df7fbfedba1471eb1e4d0da9dba88d450366ebb40b378b0c043352689a0bf572
                                                          • Opcode Fuzzy Hash: b856a6c3ddb8265ddbab391a547f29f04b95ec63c13d1469ac7007ed99c0b34b
                                                          • Instruction Fuzzy Hash: 8A210372500604DFDF19DF10D9C0F26BB66FB88324F20C169E84A0B356C33AF856CAA2
                                                          Function 02DED01C Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588563903.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ded000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1d4af384a5857da1e9a7e68e1e6ed79de1af9f792c5b2441b96c30b944c5dc61
                                                          • Instruction ID: ee7299e21b3a11161e5552ec475b79762e828e219f37b8df67dacfb3e2ecb7ee
                                                          • Opcode Fuzzy Hash: 1d4af384a5857da1e9a7e68e1e6ed79de1af9f792c5b2441b96c30b944c5dc61
                                                          • Instruction Fuzzy Hash: 3221D071604344DFDF15EF10D980B16BB6AEB88214F38C569E84A4B396CB3AD847CA62
                                                          Function 02DED1D4 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588563903.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ded000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2a6ce26308d8ea9d2d1ea4e15e5ce07f9db9335c7e7b9c7cca499402cdf3e328
                                                          • Instruction ID: 9898833f60ba773d908022ab2a221c4781e7af958c080a7d1fb22c245de6db04
                                                          • Opcode Fuzzy Hash: 2a6ce26308d8ea9d2d1ea4e15e5ce07f9db9335c7e7b9c7cca499402cdf3e328
                                                          • Instruction Fuzzy Hash: 6621F575504344EFDF05EF10D5C0B15BB6AFB88314F20C56DD84A4B392C736D846CA61
                                                          Function 02DED005 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588563903.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ded000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ee22c6e7185ef74b29df26866f49a08ac9f4da99ac8c7739fef1fbde7e2d7364
                                                          • Instruction ID: a98f86cae83b2b9aff7d5e723194f77c0642e7170b699bc0688a8d7f4b21a743
                                                          • Opcode Fuzzy Hash: ee22c6e7185ef74b29df26866f49a08ac9f4da99ac8c7739fef1fbde7e2d7364
                                                          • Instruction Fuzzy Hash: BA2184755093C08FCB16DF24D594715BF72EB46214F28C5EAD8498F6A7C33A980BCB62
                                                          Function 02DDD1F7 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a399c1c7e5d4767c66c0655504a55924ec654719013d5a2b029cea97317b5a7b
                                                          • Instruction ID: 935e71a7e1381ba0f096b3a229934536c11e834e7f6c10f5f5aa9cb1b8dba6c6
                                                          • Opcode Fuzzy Hash: a399c1c7e5d4767c66c0655504a55924ec654719013d5a2b029cea97317b5a7b
                                                          • Instruction Fuzzy Hash: 4D218C76504640DFCF16CF50D9C4B16BF62FB88214F24C5A9DC490A656C33AD826CBA1
                                                          Function 02DDD3D3 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction ID: 48b9ef3fed75ab250d84aee3fb72a16ff627a0d4518d7e9b9f3fe942e868687f
                                                          • Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction Fuzzy Hash: 4711AF76504640DFCF15CF10D5C4B16BF72FB84324F24C6A9D8490B656C33AE856CBA1
                                                          Function 02DED1CF Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588563903.0000000002DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ded000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction ID: add453e8f1033d25a04ca83b4210277218de0449acbb5b3f26b73d0974caf203
                                                          • Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction Fuzzy Hash: 3A118B75504280DFCB15DF10D5C4B15BBA2FB84214F24C6A9D84A4B796C33AD84ACB61
                                                          Function 02DDD745 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 83c833ab9bdb2c88b9cb73d51c2f11898d00dd7cdee2b605e0570477ec92f19f
                                                          • Instruction ID: d55545bdfae2b620647ce9e41c98affeef026b495f1bfcb476d5a9b0503fd9a6
                                                          • Opcode Fuzzy Hash: 83c833ab9bdb2c88b9cb73d51c2f11898d00dd7cdee2b605e0570477ec92f19f
                                                          • Instruction Fuzzy Hash: EF012B32404740BEFB208E11CC84B67BBA8EF41264F14C59AED0A0B382D379DC41CAB5
                                                          Function 02DDD744 Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1588310925.0000000002DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DDD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2ddd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: aa8ff0e7b3b8a9e02ae956a22820552730e6ea41372bd9a930fb4fc4574f886f
                                                          • Instruction ID: c037f2683f7842458cac8f164d6bfaea2cf2204724bc483e4b5980453b9fb8a6
                                                          • Opcode Fuzzy Hash: aa8ff0e7b3b8a9e02ae956a22820552730e6ea41372bd9a930fb4fc4574f886f
                                                          • Instruction Fuzzy Hash: DFF0C272404344AEEB208E16C884B62FF98EB41634F18C45AED094B686C3799C40CAB1

                                                          Non-executed Functions

                                                          Function 0772A570 Relevance: 1.6, Strings: 1, Instructions: 325COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: {#L
                                                          • API String ID: 0-1361971085
                                                          • Opcode ID: e87a5326a8b434eeb9faab9b79d478ae9179a675860e27ec2f845c8cf4032eb2
                                                          • Instruction ID: 227fefe605220a158e6b091334871da8b0a85f8e9576756a525c60fc8d5ab2e3
                                                          • Opcode Fuzzy Hash: e87a5326a8b434eeb9faab9b79d478ae9179a675860e27ec2f845c8cf4032eb2
                                                          • Instruction Fuzzy Hash: 69D106B1E15219DBCB18CFAAD98059EFBF2BF8A340F14D52AD425EB224D7309942CF54
                                                          Function 0772A560 Relevance: 1.6, Strings: 1, Instructions: 325COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: {#L
                                                          • API String ID: 0-1361971085
                                                          • Opcode ID: 7dd110f3df5fa5a5fd030425e6bb3a929ae76c6ba77cd6f036d436d1cea13c25
                                                          • Instruction ID: 4c181282372847ca8c92961a21c0adcf1e54aab90710467feb7092ec154d268d
                                                          • Opcode Fuzzy Hash: 7dd110f3df5fa5a5fd030425e6bb3a929ae76c6ba77cd6f036d436d1cea13c25
                                                          • Instruction Fuzzy Hash: 40D116B1E15219DFCB18CFAAC98059EFBF2BF89340F15D52AD425EB224D73099428F54
                                                          Function 077218D9 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 98R
                                                          • API String ID: 0-576591972
                                                          • Opcode ID: 86c30b8db076f00dc7ff05461deab6bae858111a620ef9d2519fea84556b9e7a
                                                          • Instruction ID: 5e8d99ae528751837d1a1e9ad4e877f5ecec7f17634011bef51fbcee709d7e7c
                                                          • Opcode Fuzzy Hash: 86c30b8db076f00dc7ff05461deab6bae858111a620ef9d2519fea84556b9e7a
                                                          • Instruction Fuzzy Hash: 6E7139B4E1425EDFCB04CF95D4819AEFBB2FB89350F64842AD465AB314D3349A42CF94
                                                          Function 07728688 Relevance: 1.4, Strings: 1, Instructions: 150COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: iUfo
                                                          • API String ID: 0-3820436262
                                                          • Opcode ID: 299e2c0c0cff124459d1ed0a3a9b780a2f24a4ff4465ecd88ae4a15b1be8ee36
                                                          • Instruction ID: 451e3c4fc1464788824b5890583ad62932efc71b01c9cd6e2d34ebc62cf6e658
                                                          • Opcode Fuzzy Hash: 299e2c0c0cff124459d1ed0a3a9b780a2f24a4ff4465ecd88ae4a15b1be8ee36
                                                          • Instruction Fuzzy Hash: FA5134B4E152199FCF08CFA9D9455EEBBF2BF89300F10902AE415FB350EB349A428B55
                                                          Function 07728698 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: iUfo
                                                          • API String ID: 0-3820436262
                                                          • Opcode ID: 431959f0b0e7be9d9f9bc7201e98b52d2335c336498b138f9def2083692df541
                                                          • Instruction ID: 6f75817b47b9f8951269943b4fe5115a3873b55be812f1b94c50d49e31770877
                                                          • Opcode Fuzzy Hash: 431959f0b0e7be9d9f9bc7201e98b52d2335c336498b138f9def2083692df541
                                                          • Instruction Fuzzy Hash: EB5123B4E112299FCB08CFA9D9455EEFBF2BF89300F10902AE415BB354EB3499428F55
                                                          Function 07721440 Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: -2m
                                                          • API String ID: 0-2686427999
                                                          • Opcode ID: 39b5cb55f83c0f8a866fa1a98fbe6226c89b06418b029051bf411485b4926851
                                                          • Instruction ID: 0322358ab087f93cc50006a36ba5e7b468d53f7354be60676a6f8e966f6b299d
                                                          • Opcode Fuzzy Hash: 39b5cb55f83c0f8a866fa1a98fbe6226c89b06418b029051bf411485b4926851
                                                          • Instruction Fuzzy Hash: 45512BB0E142198FDB08CFAAD5406AEFFF2FF89341F64D06AD41AA7254D7348A41DB64
                                                          Function 07728A90 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: w7e^
                                                          • API String ID: 0-1657886525
                                                          • Opcode ID: 77db235dca54f027b45e84e549a79b6cfe4a91d0c04e38f9e492e20e856eb4a6
                                                          • Instruction ID: 4c28a706bb1b3b5f5600bb52f9658a0249e0c5062f7cceaa9a3307e403f7ccee
                                                          • Opcode Fuzzy Hash: 77db235dca54f027b45e84e549a79b6cfe4a91d0c04e38f9e492e20e856eb4a6
                                                          • Instruction Fuzzy Hash: F14158B0D14269DFCF04CFA6C8415EEFBB1FB8A280F14982AC426B7254D7394642CF59
                                                          Function 07728A80 Relevance: 1.4, Strings: 1, Instructions: 123COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: w7e^
                                                          • API String ID: 0-1657886525
                                                          • Opcode ID: bb8bf7f9b58725201706065ee60d7f93b20560766454f44760f15c5e79ebc39b
                                                          • Instruction ID: acabe6344de84cff4fa9fbaa2e4702a25314dac7d4eea505c775886e02bc7882
                                                          • Opcode Fuzzy Hash: bb8bf7f9b58725201706065ee60d7f93b20560766454f44760f15c5e79ebc39b
                                                          • Instruction Fuzzy Hash: 534148B5D15269CFCF04CFA6C8416EEFBB1FB8A240F14982AC426B7254D7394642CF5A
                                                          Function 07725588 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0ni
                                                          • API String ID: 0-1488673370
                                                          • Opcode ID: 588adbfed087228b08b5853498047a782a68f6ee6c143f78d396e65198d2a216
                                                          • Instruction ID: 921872803b0b1b7dc546f1a54f269a669de379c2a53046bb16b4acacccbcbe49
                                                          • Opcode Fuzzy Hash: 588adbfed087228b08b5853498047a782a68f6ee6c143f78d396e65198d2a216
                                                          • Instruction Fuzzy Hash: C8515BB1E116188BDB68DF6B8D4579EFBF3BFC9200F14C1BA950DA6214EB340A858F51
                                                          Function 0772557A Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0ni
                                                          • API String ID: 0-1488673370
                                                          • Opcode ID: 2ef1324eb97596928d564ef3758cab99e911e0bbd8696b526b4f59df7cffed5f
                                                          • Instruction ID: 72cdb864738615884ff7dcfbf674122ec30e6189e7d906d7328cb223f7cb3b61
                                                          • Opcode Fuzzy Hash: 2ef1324eb97596928d564ef3758cab99e911e0bbd8696b526b4f59df7cffed5f
                                                          • Instruction Fuzzy Hash: AB516C71E056588BDB58CF6B8D4479AFBF3BFC9200F14C1BA850DA6254EB340A858F51
                                                          Function 02EBD404 Relevance: .3, Instructions: 264COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1589028609.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_2eb0000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 51325931cc5b4ca2d9b6041915a211d4b4f6d18362a88624902b14f6100d1af6
                                                          • Instruction ID: 385fa9fcac7ab4ff6b5ec65ff6911025457cfeb5260c144bfdb462d26c090fc1
                                                          • Opcode Fuzzy Hash: 51325931cc5b4ca2d9b6041915a211d4b4f6d18362a88624902b14f6100d1af6
                                                          • Instruction Fuzzy Hash: D1A16832E402098FCF06DFB5C8405DEB7B2FF85304B2595AAF805AB265DB31E956CB80
                                                          Function 07729FC8 Relevance: .3, Instructions: 254COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c34f34ebd0eae9e7be6d15d24cfaa0e6e04d425cebae1951c05cede546825843
                                                          • Instruction ID: 42245a44c169bc7b24fde381a44182fa11914bea9a10c2ba0614d3ba893a126a
                                                          • Opcode Fuzzy Hash: c34f34ebd0eae9e7be6d15d24cfaa0e6e04d425cebae1951c05cede546825843
                                                          • Instruction Fuzzy Hash: CEB1E8B1D15219DFCF18CFA6D54059EFBB2BF89340F20D42AD429A7254EB34AA06DF10
                                                          Function 07729FBA Relevance: .3, Instructions: 253COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fef42a83625edc7646f9ef1c2b95b20b430043b5650ab63e400b03a1233e52ec
                                                          • Instruction ID: f82b167fa5dc6bd961a0adc6c766f74e58ac13ac836613bce5bfc8f3a6dedb7d
                                                          • Opcode Fuzzy Hash: fef42a83625edc7646f9ef1c2b95b20b430043b5650ab63e400b03a1233e52ec
                                                          • Instruction Fuzzy Hash: 4BB1F7B1D152199FCF18CFA6D58159EFBB2FF89340F20D42AD429A7254EB34AA06DF10
                                                          Function 07723CF8 Relevance: .2, Instructions: 197COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8a6ca61fd5762944be275d14145586170597b4a519a4a57fa53db58b3c70832d
                                                          • Instruction ID: 6f1409c8e860e0d7df173657354ca7109aea33a040f352fd8bdb35071541b1f7
                                                          • Opcode Fuzzy Hash: 8a6ca61fd5762944be275d14145586170597b4a519a4a57fa53db58b3c70832d
                                                          • Instruction Fuzzy Hash: EC81F474A2525ACFCB04CFA9D58489EFBF1FF89350F24956AD425AB220D334AA42CF51
                                                          Function 07723D08 Relevance: .2, Instructions: 196COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f6032b56bfbf9ffedb0d4b931f6411a69b5b640dedbcce85d4e061d3996649b9
                                                          • Instruction ID: d3b9fd6a7b63472259af2942e25176b6e3b4a3355653ef3aecb1a3708aa246ec
                                                          • Opcode Fuzzy Hash: f6032b56bfbf9ffedb0d4b931f6411a69b5b640dedbcce85d4e061d3996649b9
                                                          • Instruction Fuzzy Hash: 7A91E2B4A1521ACFCB04CF99C58489EFBF1FF89350F24955AD425AB224D334AA42CF51
                                                          Function 07728E40 Relevance: .2, Instructions: 190COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 45f1563058b8b5e1ffcfeb230ed86f298c568a3fe3d139fd76e1b58ed52ad3f9
                                                          • Instruction ID: 24f3ff0d06955613398d7bef2deaf8b0d68a144e4c609cca988be9bed9ef2731
                                                          • Opcode Fuzzy Hash: 45f1563058b8b5e1ffcfeb230ed86f298c568a3fe3d139fd76e1b58ed52ad3f9
                                                          • Instruction Fuzzy Hash: 5D813EB4E10229CFDB14CF69C5806AEFBB6FF89300F24C569D418A7256D734AA42CF61
                                                          Function 07725108 Relevance: .2, Instructions: 175COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bd885183f5616c72629e409f96ca278c51dd78dbef6480ff9bf47cd9dc88dde7
                                                          • Instruction ID: ded58ff0e12186891100bd33507764f9e933503e259eb66d3561075eb7f61def
                                                          • Opcode Fuzzy Hash: bd885183f5616c72629e409f96ca278c51dd78dbef6480ff9bf47cd9dc88dde7
                                                          • Instruction Fuzzy Hash: 2F7137B4E156198FCB04CFA9C9805DEFBF2FF89250F24946AD415BB264E3349A428B64
                                                          Function 07725118 Relevance: .2, Instructions: 173COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 23e392be569a3417ab51b805efae887b0232363e4fbfb51ae14f1cb1898e9745
                                                          • Instruction ID: 5e46585ea05ca849d1b666df368bf79245946c2cab2f26b06b6c9e2059c2e514
                                                          • Opcode Fuzzy Hash: 23e392be569a3417ab51b805efae887b0232363e4fbfb51ae14f1cb1898e9745
                                                          • Instruction Fuzzy Hash: 187126B4E15219CFCB04CFA9C9805DEFBF2FF89350F24946AD415BB224E3349A528B64
                                                          Function 07723ADA Relevance: .1, Instructions: 137COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e9477ff7a08ab3fc9e2effb1ba1c4c0cb6d3b680a9f7a3c1ec03b9827a2bd1c2
                                                          • Instruction ID: 5252ccb7ea10171e28f1a7b685eb21708c284aff54179263f9ee0b6a5663a61b
                                                          • Opcode Fuzzy Hash: e9477ff7a08ab3fc9e2effb1ba1c4c0cb6d3b680a9f7a3c1ec03b9827a2bd1c2
                                                          • Instruction Fuzzy Hash: 4E51BDB0D08259AFCB04CFA9C4805AEFFB1FF86340F54C59AC465AB252D3389A42DF91
                                                          Function 07724F00 Relevance: .1, Instructions: 115COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f5ecff7216fb432dfb87e718ddc07d25a92b60a77841ac373244cb48cd3d171e
                                                          • Instruction ID: 387a1b2fe921a4c12de2b444c0eee2389b51f9a67a389f4e64e719de6a9d7c98
                                                          • Opcode Fuzzy Hash: f5ecff7216fb432dfb87e718ddc07d25a92b60a77841ac373244cb48cd3d171e
                                                          • Instruction Fuzzy Hash: 04413AB0E0425A9FCB08CFAAD4815AEFBF2FF89340F14C46AD425A7244D3349A428F94
                                                          Function 07728348 Relevance: .1, Instructions: 112COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8c8612f785ddc5725f26289cc4143224856b65adc6afb1d135fe0829348309c6
                                                          • Instruction ID: df81ab55e292dd4a56a22eed81da302cc04946570da0efa53da2a8ee64aaa49e
                                                          • Opcode Fuzzy Hash: 8c8612f785ddc5725f26289cc4143224856b65adc6afb1d135fe0829348309c6
                                                          • Instruction Fuzzy Hash: F1419EB0E0961ADFCB04CFA5D5416AEFBF2EF89340F20D56AC114B7265D3748B428B96
                                                          Function 077253A8 Relevance: .1, Instructions: 108COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8c263080bccd4c2d170602adddee0dc59518d190a6351dc2ce087e1ddd5a160c
                                                          • Instruction ID: 196f2c7d9eeefa46777569c11f1523330ce6125f63483d6fa0dedd1d166bf754
                                                          • Opcode Fuzzy Hash: 8c263080bccd4c2d170602adddee0dc59518d190a6351dc2ce087e1ddd5a160c
                                                          • Instruction Fuzzy Hash: 8F4128B0E0521ADFCB04CFAAC5815AEFBF2FF89340F20D5AAC415B7214D7309A529B94
                                                          Function 07725398 Relevance: .1, Instructions: 108COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5497fc4d37adbc6967aad021eba0d40bdb253a85e87c523d58e856382e39166e
                                                          • Instruction ID: 9f5a458bf161df3058a97f598ff338859ff0c44c031a659a9c6ba01c0e0249dc
                                                          • Opcode Fuzzy Hash: 5497fc4d37adbc6967aad021eba0d40bdb253a85e87c523d58e856382e39166e
                                                          • Instruction Fuzzy Hash: C1412AB0E0521ADBCB04CFA9C5816AEFBF2FF88340F24D569C415A7214D7709A529B94
                                                          Function 07728358 Relevance: .1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1dcee51eaafbc617e377cfc23da00cedae290d8d5e04cf256c305d0e7c8826ee
                                                          • Instruction ID: fb5d0c85783865d2c06478cfe5e7698fba01a816eb1432ef0d279dcc614225dc
                                                          • Opcode Fuzzy Hash: 1dcee51eaafbc617e377cfc23da00cedae290d8d5e04cf256c305d0e7c8826ee
                                                          • Instruction Fuzzy Hash: 66416DB0E1921ADFCB04CFA6C5416AEFBF1EF89340F20D46AC115B7264E37497028B95
                                                          Function 07724F10 Relevance: .1, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c48a644b01403e90d28a9f23ac36d97ebd1954b7a6cdad7414076b81101e9b6d
                                                          • Instruction ID: 2c8e301f266b66b5d3748e43c7f863bc423665e7ea05022c3549bc257e990141
                                                          • Opcode Fuzzy Hash: c48a644b01403e90d28a9f23ac36d97ebd1954b7a6cdad7414076b81101e9b6d
                                                          • Instruction Fuzzy Hash: AA41D4B0E1421ADBCB48CFAAC4815AEFBF2BF89340F14C46AD425B7254D7349A429F94
                                                          Function 07720007 Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4f4446781d7132ca8230b98516b7870baa0234ecd6d98dcf4351b380e2ba05e2
                                                          • Instruction ID: 1fd74c554553bb47be5e428e2b5d347b7f953a85247194d1df662514bf82b15d
                                                          • Opcode Fuzzy Hash: 4f4446781d7132ca8230b98516b7870baa0234ecd6d98dcf4351b380e2ba05e2
                                                          • Instruction Fuzzy Hash: 84313271E057548FE71ACF679C0029AFFF3AFCA210F08C0A7C454AA165D6350946CF65
                                                          Function 07720040 Relevance: .1, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1611862646.0000000007720000.00000040.00000800.00020000.00000000.sdmp, Offset: 07720000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7720000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dbb09b9debe3f8bdc4c5a8ee0373478bb80156a16f61f9bd1ee5d365ccc318fd
                                                          • Instruction ID: 06525dc9f1f39bbf67c8e8c63778438f58dab1dc37bcbdeeb808c0e178829423
                                                          • Opcode Fuzzy Hash: dbb09b9debe3f8bdc4c5a8ee0373478bb80156a16f61f9bd1ee5d365ccc318fd
                                                          • Instruction Fuzzy Hash: 0611DDB1E006189BEB5CCFABD80069EFAF7AFC9200F04C07AC918B6254EB7005568F65

                                                          Execution Graph

                                                          Execution Coverage:11.7%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:0%
                                                          Total number of Nodes:144
                                                          Total number of Limit Nodes:16
                                                          execution_graph 39850 6982c88 39851 6982cce GetCurrentProcess 39850->39851 39853 6982d19 39851->39853 39854 6982d20 GetCurrentThread 39851->39854 39853->39854 39855 6982d5d GetCurrentProcess 39854->39855 39856 6982d56 39854->39856 39857 6982d93 39855->39857 39856->39855 39858 6982dbb GetCurrentThreadId 39857->39858 39859 6982dec 39858->39859 39844 6982ed0 DuplicateHandle 39845 6982f66 39844->39845 39846 698d390 39847 698d3f8 CreateWindowExW 39846->39847 39849 698d4b4 39847->39849 39849->39849 39860 10bd030 39861 10bd048 39860->39861 39862 10bd0a2 39861->39862 39868 698d598 39861->39868 39873 698d537 39861->39873 39877 698a32c 39861->39877 39886 698e698 39861->39886 39895 698d548 39861->39895 39869 698d587 39868->39869 39871 698d5a6 39868->39871 39870 698a32c CallWindowProcW 39869->39870 39872 698d58f 39870->39872 39871->39862 39872->39862 39874 698d545 39873->39874 39875 698d58f 39874->39875 39876 698a32c CallWindowProcW 39874->39876 39875->39862 39876->39875 39878 698a337 39877->39878 39879 698e709 39878->39879 39881 698e6f9 39878->39881 39882 698e707 39879->39882 39915 698e2fc 39879->39915 39899 698e8fc 39881->39899 39905 698e820 39881->39905 39910 698e830 39881->39910 39888 698e6a8 39886->39888 39887 698e709 39889 698e2fc CallWindowProcW 39887->39889 39891 698e707 39887->39891 39888->39887 39890 698e6f9 39888->39890 39889->39891 39892 698e8fc CallWindowProcW 39890->39892 39893 698e830 CallWindowProcW 39890->39893 39894 698e820 CallWindowProcW 39890->39894 39892->39891 39893->39891 39894->39891 39896 698d56e 39895->39896 39897 698d58f 39896->39897 39898 698a32c CallWindowProcW 39896->39898 39897->39862 39898->39897 39900 698e8ba 39899->39900 39901 698e90a 39899->39901 39919 698e8e8 39900->39919 39922 698e8d8 39900->39922 39902 698e8d0 39902->39882 39907 698e82e 39905->39907 39906 698e8d0 39906->39882 39908 698e8d8 CallWindowProcW 39907->39908 39909 698e8e8 CallWindowProcW 39907->39909 39908->39906 39909->39906 39912 698e844 39910->39912 39911 698e8d0 39911->39882 39913 698e8d8 CallWindowProcW 39912->39913 39914 698e8e8 CallWindowProcW 39912->39914 39913->39911 39914->39911 39916 698e307 39915->39916 39917 698fb6a CallWindowProcW 39916->39917 39918 698fb19 39916->39918 39917->39918 39918->39882 39920 698e8f9 39919->39920 39926 698faa0 39919->39926 39920->39902 39923 698e8e8 39922->39923 39924 698faa0 CallWindowProcW 39923->39924 39925 698e8f9 39923->39925 39924->39925 39925->39902 39927 698e2fc CallWindowProcW 39926->39927 39928 698faba 39927->39928 39928->39920 39929 1100b4d 39930 1100b55 39929->39930 39932 110084e 39929->39932 39931 110091b 39932->39931 39937 6981b80 39932->39937 39941 6981c03 39932->39941 39947 6981b70 39932->39947 39951 1101380 39932->39951 39938 6981b8f 39937->39938 39955 6981578 39938->39955 39942 6981b6a 39941->39942 39946 6981c0a 39941->39946 39943 6981bd7 39942->39943 39944 6981578 GetModuleHandleW 39942->39944 39943->39932 39945 6981bb0 39944->39945 39945->39932 39946->39932 39948 6981b8f 39947->39948 39949 6981578 GetModuleHandleW 39948->39949 39950 6981bb0 39949->39950 39950->39932 39952 1101396 39951->39952 39953 1101480 39952->39953 40009 1107eb0 39952->40009 39953->39932 39956 6981583 39955->39956 39959 6982a24 39956->39959 39958 6983536 39958->39958 39960 6982a2f 39959->39960 39961 6983c5c 39960->39961 39963 69854e0 39960->39963 39961->39958 39964 6985501 39963->39964 39965 6985525 39964->39965 39967 6985a98 39964->39967 39965->39961 39968 6985aa5 39967->39968 39969 6985ade 39968->39969 39971 6985684 39968->39971 39969->39965 39972 698568f 39971->39972 39973 6985b50 39972->39973 39975 69856b8 39972->39975 39976 69856c3 39975->39976 39982 69856c8 39976->39982 39978 6985bbf 39986 698aee0 39978->39986 39992 698aec8 39978->39992 39979 6985bf9 39979->39973 39983 69856d3 39982->39983 39984 6986e48 39983->39984 39985 69854e0 GetModuleHandleW 39983->39985 39984->39978 39985->39984 39988 698af5d 39986->39988 39989 698af11 39986->39989 39987 698af1d 39987->39979 39988->39979 39989->39987 39997 698b158 39989->39997 40000 698b148 39989->40000 39994 698aee0 39992->39994 39993 698af1d 39993->39979 39994->39993 39995 698b158 GetModuleHandleW 39994->39995 39996 698b148 GetModuleHandleW 39994->39996 39995->39993 39996->39993 40004 698b198 39997->40004 39998 698b162 39998->39988 40001 698b158 40000->40001 40003 698b198 GetModuleHandleW 40001->40003 40002 698b162 40002->39988 40003->40002 40006 698b19d 40004->40006 40005 698b1dc 40005->39998 40006->40005 40007 698b3e0 GetModuleHandleW 40006->40007 40008 698b40d 40007->40008 40008->39998 40010 1107eba 40009->40010 40011 1107ed4 40010->40011 40014 699fa18 40010->40014 40018 699fa0a 40010->40018 40011->39952 40016 699fa2d 40014->40016 40015 699fc42 40015->40011 40016->40015 40017 699fc58 GlobalMemoryStatusEx GlobalMemoryStatusEx 40016->40017 40017->40016 40020 699fa2d 40018->40020 40019 699fc42 40019->40011 40020->40019 40021 699fc58 GlobalMemoryStatusEx GlobalMemoryStatusEx 40020->40021 40021->40020

                                                          Executed Functions

                                                          Function 0699234A Relevance: 1.0, Instructions: 1008COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ef5d7552205a0f8c8907556afb47b0f1e3d3911e2b0b15a389106f150d2e41b6
                                                          • Instruction ID: 3a902c1e1180cde6cc359da04107ee74f7aac017bac52e87b6033dd6933e91e3
                                                          • Opcode Fuzzy Hash: ef5d7552205a0f8c8907556afb47b0f1e3d3911e2b0b15a389106f150d2e41b6
                                                          • Instruction Fuzzy Hash: 25926834E102049FDFA4CB68C588A5DB7F6FF49314F6484A9D409AB761DB35ED81CBA0
                                                          Function 069965E0 Relevance: .8, Instructions: 814COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 91446cf510c31cfa81c349b42102940a321e59a40cc5c082cc9cd5a00fb58e07
                                                          • Instruction ID: eefc522b90b79660c88eb7d71405555d69de0e0af8a194392a44544bfd92b405
                                                          • Opcode Fuzzy Hash: 91446cf510c31cfa81c349b42102940a321e59a40cc5c082cc9cd5a00fb58e07
                                                          • Instruction Fuzzy Hash: 63629A34B102048FEF54DBA8D594BADB7F6EB88314F248469E406DB790DB75EC81CBA0
                                                          Function 06995588 Relevance: .6, Instructions: 609COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6f68d8345be0d1bc21181c6a281c41c75514b9348b16b8be8a3753218bdbbf18
                                                          • Instruction ID: b31a1a779267ccaf91576b87d2a4daa66762540542049f7bea446d1b250b6aa6
                                                          • Opcode Fuzzy Hash: 6f68d8345be0d1bc21181c6a281c41c75514b9348b16b8be8a3753218bdbbf18
                                                          • Instruction Fuzzy Hash: 8522BE31F002148FEF66CBA9C4806AEBBB6FF85320F258469D556AB741DA35DD41CBA0
                                                          Function 0699B20F Relevance: .6, Instructions: 583COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5e8b79d1964306b56e11e35dd317dc1b36458e24fccc0d46b4f8c8956eaa5bb0
                                                          • Instruction ID: 1b76b4d48866eedd7c4c40d390bf12d722c274b821b02e560ca45796de99945c
                                                          • Opcode Fuzzy Hash: 5e8b79d1964306b56e11e35dd317dc1b36458e24fccc0d46b4f8c8956eaa5bb0
                                                          • Instruction Fuzzy Hash: 7E225F30E101098FEF64CB9DE4947AEB7BAFB85310F248526E445DBB95DA38DC81CB61
                                                          Function 06993040 Relevance: .5, Instructions: 545COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 342f0301ea499e1fd835b0bedf1c39e12bdb43877251a790f22d396768b4f440
                                                          • Instruction ID: ea5285db5397a247bab6fe65b66a435d88fd287d056115825e1224cf2c36bb18
                                                          • Opcode Fuzzy Hash: 342f0301ea499e1fd835b0bedf1c39e12bdb43877251a790f22d396768b4f440
                                                          • Instruction Fuzzy Hash: CA323D30E10619CFDB24DF69D89469DB7B6FF99300F20866AD40AA7251EB70AD85CF90
                                                          Function 06997D68 Relevance: .5, Instructions: 476COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0e3757109976785fd4f50ce6a1935b4c0bffafeeb776208b3a32d2b77ba8487e
                                                          • Instruction ID: 16c2c9b647dcd888c5a1d43054c29dfe4c3d62d5c86a2ac83d34e493af073ef3
                                                          • Opcode Fuzzy Hash: 0e3757109976785fd4f50ce6a1935b4c0bffafeeb776208b3a32d2b77ba8487e
                                                          • Instruction Fuzzy Hash: 01028C30B102058FDF54DBA8D594BAEB7E6FF85310F248929D4059B781DB75EC82CBA0
                                                          Function 06982C83 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentProcess.KERNEL32 ref: 06982D06
                                                          • GetCurrentThread.KERNEL32 ref: 06982D43
                                                          • GetCurrentProcess.KERNEL32 ref: 06982D80
                                                          • GetCurrentThreadId.KERNEL32 ref: 06982DD9
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Current$ProcessThread
                                                          • String ID:
                                                          • API String ID: 2063062207-0
                                                          • Opcode ID: 85eb342f206ed2a3348e790f5a5e6b52bdf9585801dce2902ca797a1736f4989
                                                          • Instruction ID: 0f8d8325481c91616f7ccc5c7dc435072c7106b2ac5549dd2e5cdf2f79548796
                                                          • Opcode Fuzzy Hash: 85eb342f206ed2a3348e790f5a5e6b52bdf9585801dce2902ca797a1736f4989
                                                          • Instruction Fuzzy Hash: 355167B09003098FDB54DFAAD948BDEBBF5FF88304F24801AE419A7750D7786985CBA5
                                                          Function 06982C88 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentProcess.KERNEL32 ref: 06982D06
                                                          • GetCurrentThread.KERNEL32 ref: 06982D43
                                                          • GetCurrentProcess.KERNEL32 ref: 06982D80
                                                          • GetCurrentThreadId.KERNEL32 ref: 06982DD9
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: Current$ProcessThread
                                                          • String ID:
                                                          • API String ID: 2063062207-0
                                                          • Opcode ID: 9a9b2faf40af19d908ff38f5ad2c6fd37a5a3cc26077477364122c16d01bf637
                                                          • Instruction ID: 6280b46685588718c994a942c1f68bf07db2691cf76e8b85f9e7e8afbfbc73e1
                                                          • Opcode Fuzzy Hash: 9a9b2faf40af19d908ff38f5ad2c6fd37a5a3cc26077477364122c16d01bf637
                                                          • Instruction Fuzzy Hash: A95166B09003098FDB54DFAAD948BDEBBF1FF88304F24801AE01AA7750D778A945CB65
                                                          Function 06994B50 Relevance: 3.9, Strings: 3, Instructions: 186COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 45 6994b50-6994b74 46 6994b76-6994b79 45->46 47 6995258-699525b 46->47 48 6994b7f-6994c77 46->48 49 699525d-6995277 47->49 50 699527c-699527e 47->50 68 6994cfa-6994d01 48->68 69 6994c7d-6994cca call 69953f8 48->69 49->50 52 6995280 50->52 53 6995285-6995288 50->53 52->53 53->46 54 699528e-699529b 53->54 70 6994d85-6994d8e 68->70 71 6994d07-6994d77 68->71 82 6994cd0-6994cec 69->82 70->54 88 6994d79 71->88 89 6994d82 71->89 85 6994cee 82->85 86 6994cf7 82->86 85->86 86->68 88->89 89->70
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: fq$XPq$\Oq
                                                          • API String ID: 0-132346853
                                                          • Opcode ID: b4bfa6589816a6da921b35e99d94d2b35ea7bcd12c8dc6803048afc28248e01e
                                                          • Instruction ID: df700e9f2e6f39f656e64794b246722152612a9504c9f6a599a41973927029bc
                                                          • Opcode Fuzzy Hash: b4bfa6589816a6da921b35e99d94d2b35ea7bcd12c8dc6803048afc28248e01e
                                                          • Instruction Fuzzy Hash: 83617130F002199FEF559BA8C8147AEBAF6FF88700F20852AD506AB795DF754C45CB90
                                                          Function 0698B198 Relevance: 1.7, APIs: 1, Instructions: 203COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 703 698b198-698b1b7 705 698b1b9-698b1c6 call 698a148 703->705 706 698b1e3-698b1e7 703->706 713 698b1c8 705->713 714 698b1dc 705->714 707 698b1e9-698b1f3 706->707 708 698b1fb-698b23c 706->708 707->708 715 698b249-698b257 708->715 716 698b23e-698b246 708->716 760 698b1ce call 698b440 713->760 761 698b1ce call 698b432 713->761 714->706 717 698b259-698b25e 715->717 718 698b27b-698b27d 715->718 716->715 721 698b269 717->721 722 698b260-698b267 call 698a154 717->722 720 698b280-698b287 718->720 719 698b1d4-698b1d6 719->714 723 698b318-698b3d8 719->723 724 698b289-698b291 720->724 725 698b294-698b29b 720->725 727 698b26b-698b279 721->727 722->727 755 698b3da-698b3dd 723->755 756 698b3e0-698b40b GetModuleHandleW 723->756 724->725 728 698b2a8-698b2b1 call 6983794 725->728 729 698b29d-698b2a5 725->729 727->720 735 698b2be-698b2c3 728->735 736 698b2b3-698b2bb 728->736 729->728 737 698b2e1-698b2ee 735->737 738 698b2c5-698b2cc 735->738 736->735 744 698b2f0-698b30e 737->744 745 698b311-698b317 737->745 738->737 740 698b2ce-698b2de call 6988968 call 698a164 738->740 740->737 744->745 755->756 757 698b40d-698b413 756->757 758 698b414-698b428 756->758 757->758 760->719 761->719
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0698B3FE
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: 072a44f590fda372abefcd1cb2051a0520e8e4b31cd5c2cc88ef903c1446da9b
                                                          • Instruction ID: e3cf4423752b687863084192dbca5f402299ee6118065e81377a1aa894c3772e
                                                          • Opcode Fuzzy Hash: 072a44f590fda372abefcd1cb2051a0520e8e4b31cd5c2cc88ef903c1446da9b
                                                          • Instruction Fuzzy Hash: 0A818970A00B058FD7A4EF2AD44475ABBF5FF88200F14892DD49ADBB54D779E846CB90
                                                          Function 0110EB38 Relevance: 1.7, APIs: 1, Instructions: 161COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 762 110eb38-110eb40 763 110eb42-110eb53 762->763 764 110eaff-110eb18 call 110eb38 762->764 765 110eb55-110eb7c 763->765 766 110eb7d-110eb93 763->766 770 110eb1e-110eb22 764->770 792 110eb95 call 110ec20 766->792 793 110eb95 call 110eb38 766->793 771 110eb24-110eb29 770->771 772 110eb2b-110eb2e 770->772 773 110eb31-110eb33 771->773 772->773 774 110eb9a-110eb9c 775 110eba2-110ec01 774->775 776 110eb9e-110eba1 774->776 783 110ec03-110ec06 775->783 784 110ec07-110ec94 GlobalMemoryStatusEx 775->784 788 110ec96-110ec9c 784->788 789 110ec9d-110ecc5 784->789 788->789 792->774 793->774
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2819670107.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_1100000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6b571a7f5805ed77a0e04b678bcee2fe70098bd06b4975e51e841da20d3cf65f
                                                          • Instruction ID: edb30177ac378f3455478cb111f7610d299853af494fd8d09554fa18bc2b9379
                                                          • Opcode Fuzzy Hash: 6b571a7f5805ed77a0e04b678bcee2fe70098bd06b4975e51e841da20d3cf65f
                                                          • Instruction Fuzzy Hash: F3517831D053999FDB19CF79D8046EEBFF5AFCA210F04856AD405A7282DB749845CBE0
                                                          Function 0698D384 Relevance: 1.6, APIs: 1, Instructions: 118COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 927 698d384-698d3f6 929 698d3f8-698d3fe 927->929 930 698d401-698d408 927->930 929->930 931 698d40a-698d410 930->931 932 698d413-698d44b 930->932 931->932 933 698d453-698d4b2 CreateWindowExW 932->933 934 698d4bb-698d4f3 933->934 935 698d4b4-698d4ba 933->935 939 698d500 934->939 940 698d4f5-698d4f8 934->940 935->934 941 698d501 939->941 940->939 941->941
                                                          APIs
                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0698D4A2
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: CreateWindow
                                                          • String ID:
                                                          • API String ID: 716092398-0
                                                          • Opcode ID: f8423a26d7a318d36c8fa6779c8f07308f737df717c37fda21666a3fee03e400
                                                          • Instruction ID: b9e7867b2e2510871cce3956b0db46afe855542f0c0c73919bc3c5378aa9a082
                                                          • Opcode Fuzzy Hash: f8423a26d7a318d36c8fa6779c8f07308f737df717c37fda21666a3fee03e400
                                                          • Instruction Fuzzy Hash: 1651D2B1D003489FDB14DFA9C884ADEBBB5FF88314F64812AE819AB250D775A845CF90
                                                          Function 0698D390 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 942 698d390-698d3f6 943 698d3f8-698d3fe 942->943 944 698d401-698d408 942->944 943->944 945 698d40a-698d410 944->945 946 698d413-698d4b2 CreateWindowExW 944->946 945->946 948 698d4bb-698d4f3 946->948 949 698d4b4-698d4ba 946->949 953 698d500 948->953 954 698d4f5-698d4f8 948->954 949->948 955 698d501 953->955 954->953 955->955
                                                          APIs
                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0698D4A2
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: CreateWindow
                                                          • String ID:
                                                          • API String ID: 716092398-0
                                                          • Opcode ID: 55a0830cf33c679fd82b98ef7c9f48a2e0ac2d333c8ebf9434acc9e52e99de9b
                                                          • Instruction ID: 3a20d5581ceba8fd9a883de263f8e01e0e087a5b5b119d1ceda9397f0ef1a36a
                                                          • Opcode Fuzzy Hash: 55a0830cf33c679fd82b98ef7c9f48a2e0ac2d333c8ebf9434acc9e52e99de9b
                                                          • Instruction Fuzzy Hash: 1A41C2B1D003489FDB14DFA9C884ADEBBB5FF88310F24812AE819AB250D775A845CF90
                                                          Function 0698E2FC Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 956 698e2fc-698fb0c 959 698fbbc-698fbdc call 698a32c 956->959 960 698fb12-698fb17 956->960 967 698fbdf-698fbec 959->967 962 698fb19-698fb50 960->962 963 698fb6a-698fba2 CallWindowProcW 960->963 970 698fb59-698fb68 962->970 971 698fb52-698fb58 962->971 964 698fbab-698fbba 963->964 965 698fba4-698fbaa 963->965 964->967 965->964 970->967 971->970
                                                          APIs
                                                          • CallWindowProcW.USER32(?,?,?,?,?), ref: 0698FB91
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: CallProcWindow
                                                          • String ID:
                                                          • API String ID: 2714655100-0
                                                          • Opcode ID: 63c982863c489df1dbc4dbdc5d7dbef2795e66ffe54d448f5ad33a054069b36c
                                                          • Instruction ID: a6aaa793030a2a76f0b5ebddaa114b097e994dd7aa24b1d01036f8d97565c5c2
                                                          • Opcode Fuzzy Hash: 63c982863c489df1dbc4dbdc5d7dbef2795e66ffe54d448f5ad33a054069b36c
                                                          • Instruction Fuzzy Hash: 074119B49003098FDB54DF95C488AAABBF5FF88314F24C459D519AB761D374A841CFA0
                                                          Function 06982EC8 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 973 6982ec8-6982ecf 974 6982ed0-6982f64 DuplicateHandle 973->974 975 6982f6d-6982f8a 974->975 976 6982f66-6982f6c 974->976 976->975
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06982F57
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: ac6d991bcad29d5ea1a7eee27b965069987fcaf8677b0684ffb8f2c49c2396c4
                                                          • Instruction ID: ca4b245d90c1fb2b68a72dcabd872c30d564052815828b4d6ce1117b8bd8c9c6
                                                          • Opcode Fuzzy Hash: ac6d991bcad29d5ea1a7eee27b965069987fcaf8677b0684ffb8f2c49c2396c4
                                                          • Instruction Fuzzy Hash: 9C21E5B5D003489FDB10DFAAD984ADEBBF9EB48310F14841AE919A7350D378A941CFA5
                                                          Function 06982ED0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 979 6982ed0-6982f64 DuplicateHandle 980 6982f6d-6982f8a 979->980 981 6982f66-6982f6c 979->981 981->980
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06982F57
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID:
                                                          • API String ID: 3793708945-0
                                                          • Opcode ID: 773054b497b4337161e2c3edf23acd1a24fc0758a2e3c390a7dadeb8105013ff
                                                          • Instruction ID: 0902a957bd70f19e769beaf2901781e5d19ee33b38e6facde0a07cc8ddc5a7d6
                                                          • Opcode Fuzzy Hash: 773054b497b4337161e2c3edf23acd1a24fc0758a2e3c390a7dadeb8105013ff
                                                          • Instruction Fuzzy Hash: 2821C4B5D003489FDB10CF9AD984ADEBBF9EB48310F14841AE918A3350D378A945CFA5
                                                          Function 0110EC20 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 984 110ec20-110ec94 GlobalMemoryStatusEx 986 110ec96-110ec9c 984->986 987 110ec9d-110ecc5 984->987 986->987
                                                          APIs
                                                          • GlobalMemoryStatusEx.KERNELBASE ref: 0110EC87
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2819670107.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_1100000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: GlobalMemoryStatus
                                                          • String ID:
                                                          • API String ID: 1890195054-0
                                                          • Opcode ID: 255dd0c3c4aae20e2dd02be1c8d175263d74049b64c1032aee2ef0dfbc8fbf59
                                                          • Instruction ID: 1370146657854843b949c3f3895aa5f45e1234dbd3dc9e3d78d84d3e6549e210
                                                          • Opcode Fuzzy Hash: 255dd0c3c4aae20e2dd02be1c8d175263d74049b64c1032aee2ef0dfbc8fbf59
                                                          • Instruction Fuzzy Hash: CA1120B1C006599BDB10CF9AC544BDEFBF4EF48220F10852AD818B7240D778A941CFA5
                                                          Function 0698B398 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 990 698b398-698b3d8 991 698b3da-698b3dd 990->991 992 698b3e0-698b40b GetModuleHandleW 990->992 991->992 993 698b40d-698b413 992->993 994 698b414-698b428 992->994 993->994
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0698B3FE
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832512525.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6980000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID:
                                                          • API String ID: 4139908857-0
                                                          • Opcode ID: b265f1108970973130f7841dc2d0ae5935b6e39c7e9f201758142627e284e155
                                                          • Instruction ID: 7a72ce8dc75ec950b70cf9de812ed8c884bbfe5978ba0b8463edc057179c6e63
                                                          • Opcode Fuzzy Hash: b265f1108970973130f7841dc2d0ae5935b6e39c7e9f201758142627e284e155
                                                          • Instruction Fuzzy Hash: EC1113B5C003498FCB10DF9AC444BDEFBF4EB88214F14841AD819A7610C379A545CFA1
                                                          Function 06994B40 Relevance: 1.4, Strings: 1, Instructions: 132COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 996 6994b40-6994b48 997 6994b4a-6994b64 996->997 998 6994b65-6994b74 996->998 997->998 999 6994b76-6994b79 998->999 1000 6995258-699525b 999->1000 1001 6994b7f-6994c77 999->1001 1002 699525d-6995277 1000->1002 1003 699527c-699527e 1000->1003 1021 6994cfa-6994d01 1001->1021 1022 6994c7d-6994cca call 69953f8 1001->1022 1002->1003 1005 6995280 1003->1005 1006 6995285-6995288 1003->1006 1005->1006 1006->999 1007 699528e-699529b 1006->1007 1023 6994d85-6994d8e 1021->1023 1024 6994d07-6994d77 1021->1024 1035 6994cd0-6994cec 1022->1035 1023->1007 1041 6994d79 1024->1041 1042 6994d82 1024->1042 1038 6994cee 1035->1038 1039 6994cf7 1035->1039 1038->1039 1039->1021 1041->1042 1042->1023
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: XPq
                                                          • API String ID: 0-1601936878
                                                          • Opcode ID: a4bc153759c90a778fc24496207851c16fcd0bdb1f59cba9ed7d24c892ed7b3d
                                                          • Instruction ID: 18d9e8294a4edaf486f0292d0df3fdb481a75d70a88b2e5051be1a13b298f605
                                                          • Opcode Fuzzy Hash: a4bc153759c90a778fc24496207851c16fcd0bdb1f59cba9ed7d24c892ed7b3d
                                                          • Instruction Fuzzy Hash: EC418470F002199FEF459BA8C814B9EBBF6FF88700F20852AD146AB795DB758C45CB90
                                                          Function 06994B78 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1044 6994b78-6994c77 1057 6994cfa-6994d01 1044->1057 1058 6994c7d-6994cca call 69953f8 1044->1058 1059 6994d85-699529b 1057->1059 1060 6994d07-6994d77 1057->1060 1072 6994cd0-6994cec 1058->1072 1078 6994d79 1060->1078 1079 6994d82 1060->1079 1075 6994cee 1072->1075 1076 6994cf7 1072->1076 1075->1076 1076->1057 1078->1079 1079->1059
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: XPq
                                                          • API String ID: 0-1601936878
                                                          • Opcode ID: 2152239ffa545c9d8c9159fb08e9b1c455b0d2a644cd1844d36deeeb2f0e1c25
                                                          • Instruction ID: 9b3b082a188e6b33d4a1087f42ce7684638cc48fd73acb3ece94b86fda2a832f
                                                          • Opcode Fuzzy Hash: 2152239ffa545c9d8c9159fb08e9b1c455b0d2a644cd1844d36deeeb2f0e1c25
                                                          • Instruction Fuzzy Hash: 3C412C74B002099FEF459FA9C414BAEBBF6FF88700F20852AE546AB395DB758C45CB50
                                                          Function 0699CF28 Relevance: .8, Instructions: 800COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5a346817acedc8dae730fda1a2f29bfb38937af931d000395d489938a737f810
                                                          • Instruction ID: 55999130f31e57be2435f8870c361066dca61795110575888f4b871627e29329
                                                          • Opcode Fuzzy Hash: 5a346817acedc8dae730fda1a2f29bfb38937af931d000395d489938a737f810
                                                          • Instruction Fuzzy Hash: EE628E30A106068FDB59DF68D590A9EB7B6FF84300B20CA29D0459F755EB79EC86CF90
                                                          Function 0699C170 Relevance: .6, Instructions: 649COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 37750875f33e87677690592ed54181c8d360cff6a416509ab8343f5effa4561c
                                                          • Instruction ID: 19320cab567ec986a6a2748b726dfa72a8126d68a7f2a0a8eea0e5c21ac48391
                                                          • Opcode Fuzzy Hash: 37750875f33e87677690592ed54181c8d360cff6a416509ab8343f5effa4561c
                                                          • Instruction Fuzzy Hash: BE325B34B10205DFDF54DBACD894BAEB7B6EB88354F208529E405DB781DB35EC818BA1
                                                          Function 0699B630 Relevance: .5, Instructions: 473COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 93b152164e99f932c6b271bb5155ded1a808aef298a819293a39678f40ef3e36
                                                          • Instruction ID: b040f15c9bb87bf9e0d19fdea9bcda1478e6b1999cbe040e47df0fdabcc46f87
                                                          • Opcode Fuzzy Hash: 93b152164e99f932c6b271bb5155ded1a808aef298a819293a39678f40ef3e36
                                                          • Instruction Fuzzy Hash: 9A025D30E102098FDF64CB5CE4847AEB7B6FB45314F208566D445DBA59DB78EC81CBA1
                                                          Function 0699ACB8 Relevance: .4, Instructions: 399COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 53a1feb67609263cee8f5b99f159cd8212244795496b0f66febd81c2600638c9
                                                          • Instruction ID: 31ee6dad67756e570dd9b463af2dd044d6fafc38827b1ddd6abdd961a886985a
                                                          • Opcode Fuzzy Hash: 53a1feb67609263cee8f5b99f159cd8212244795496b0f66febd81c2600638c9
                                                          • Instruction Fuzzy Hash: EEE17030F102098FDF69DBA8D4506AEB7B6FF89304F208529D406AB745EB74DC46CBA1
                                                          Function 06999138 Relevance: .2, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a9b17e22eb44df673ed2e460d3558d503da0473a87fd615b4332ef844ff12175
                                                          • Instruction ID: 63d45ebf7af1177a4b2c718b11faa2f64ae84a396d43166d0eb8463608a7a68c
                                                          • Opcode Fuzzy Hash: a9b17e22eb44df673ed2e460d3558d503da0473a87fd615b4332ef844ff12175
                                                          • Instruction Fuzzy Hash: 16917E34B102098FDB64DB6DD8907AE77F6FF88310F148469C40AAB745EF74AC918B91
                                                          Function 069961E0 Relevance: .2, Instructions: 229COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: afe1eca2475362f81aae5e4296cb8a4a48d0fc141b8c3fcc9c4eac27d55089f1
                                                          • Instruction ID: 023176db9e0f36a184ea06b57c8e551394f5e73cce416a1b865ba4d6b3cbd2d9
                                                          • Opcode Fuzzy Hash: afe1eca2475362f81aae5e4296cb8a4a48d0fc141b8c3fcc9c4eac27d55089f1
                                                          • Instruction Fuzzy Hash: D161C471F001104FEF559B7DC84066EBAEBAFD4210B254439E40ADB361DEB5DC0287D1
                                                          Function 06994280 Relevance: .2, Instructions: 223COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0ccdb253491f3830733c5da69aae5287f421ef237eba2aed702a27ea51696e86
                                                          • Instruction ID: 47e1b3ee31826f0ff1799daf8b7df2cf475f65b4086909698a3f35a7d1d1e56c
                                                          • Opcode Fuzzy Hash: 0ccdb253491f3830733c5da69aae5287f421ef237eba2aed702a27ea51696e86
                                                          • Instruction Fuzzy Hash: 33814C34B102058FDF55DBB9D4547AEBBF6BF88300F208529E40ADB745EA35DC828B91
                                                          Function 069945A0 Relevance: .2, Instructions: 221COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3c596b39dac8147c8700d542b550db0cbd7faf7cd068c5e8607cf65150c8bac6
                                                          • Instruction ID: e98af734ee01dea3dee5b037c0b6f1470358047b33fe4e5e06af4e23c596abf3
                                                          • Opcode Fuzzy Hash: 3c596b39dac8147c8700d542b550db0cbd7faf7cd068c5e8607cf65150c8bac6
                                                          • Instruction Fuzzy Hash: AE913E30E102198FDF55DF68C890B9DB7B1FF89310F208699D449AB691DB70A986CF91
                                                          Function 069945B8 Relevance: .2, Instructions: 210COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ac0f9d17cfd5f3d1bfd59091bee14ad485e6c3a319ad64dc8271286967761b74
                                                          • Instruction ID: 7cafd071cc144bcc043993f13151bba2b6ef0a82928fb05a64db6cd6d5c8ea64
                                                          • Opcode Fuzzy Hash: ac0f9d17cfd5f3d1bfd59091bee14ad485e6c3a319ad64dc8271286967761b74
                                                          • Instruction Fuzzy Hash: 09911C30E106198FDF65DF68C880B9DB7B1FF89314F208699D549AB341DB70AA86CF91
                                                          Function 0699EEF0 Relevance: .2, Instructions: 209COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b80ef8e0fe3543cd7aeeae08dd81d76dfd247514a20eec201ce05d47a54073b9
                                                          • Instruction ID: 0ffbdcc5227fb31566517f4766e279e0eb64f3d810b8c45404d20936937c18f0
                                                          • Opcode Fuzzy Hash: b80ef8e0fe3543cd7aeeae08dd81d76dfd247514a20eec201ce05d47a54073b9
                                                          • Instruction Fuzzy Hash: EC814A70A002099FDB55DBA8D980A9EFBFAFF89304F248529E405EB755DB70EC42CB50
                                                          Function 0699EF00 Relevance: .2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1cabcdd93e101c7e90c3cda53d3dcc1e8c95f4f22875388997c3de680ff3395a
                                                          • Instruction ID: 04aecf6b1b6f68e07e569dcfb1e230ca412f730d7208dc27531e026cc6112abd
                                                          • Opcode Fuzzy Hash: 1cabcdd93e101c7e90c3cda53d3dcc1e8c95f4f22875388997c3de680ff3395a
                                                          • Instruction Fuzzy Hash: B1714970E002098FDB55DBA8D980A9EBBFAFF88300F248429E405EB755DB74EC42CB50
                                                          Function 0699FC58 Relevance: .2, Instructions: 180COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 26d5dca6010e674c2a7e4d160f9b68453c3139b5894e5e1f19eda0ec16da0691
                                                          • Instruction ID: 97f0d07599cf3a08b8a54fbf507113e9a5d625425bd5238bf20b87e76aa52883
                                                          • Opcode Fuzzy Hash: 26d5dca6010e674c2a7e4d160f9b68453c3139b5894e5e1f19eda0ec16da0691
                                                          • Instruction Fuzzy Hash: 6C51C131E002099FDF64EBBCE4546AEF7B6FB84311F20886AE106D7751DB359855CBA0
                                                          Function 0699FA0A Relevance: .2, Instructions: 172COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b09731703875723eaa63b303f5d6db3b151533356876a23ec098f9f72f668195
                                                          • Instruction ID: 70c3821aa7097ad3ca08aecc692596ce95dd4b9080bb0c82ac64f5fe8996b806
                                                          • Opcode Fuzzy Hash: b09731703875723eaa63b303f5d6db3b151533356876a23ec098f9f72f668195
                                                          • Instruction Fuzzy Hash: 9B51E470F202044FEF645A6DD85476F666EEB89750F34482AE40AC7B91E96CCC9187A2
                                                          Function 0699FA18 Relevance: .2, Instructions: 163COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 57dd7cdfa23d29a3cb0d0adb730316ad9da93f30c86611fb35da397b76e858bd
                                                          • Instruction ID: 34f7bb57b4e9afe94ee4c27fd502e3ecdae5f37ab183fbfaf19b0e911b7cf783
                                                          • Opcode Fuzzy Hash: 57dd7cdfa23d29a3cb0d0adb730316ad9da93f30c86611fb35da397b76e858bd
                                                          • Instruction Fuzzy Hash: 4A51A1B0F202045FEF645A6DD89472F626EE789760F34482AD50EC7B90E9ACCCD147A2
                                                          Function 06999127 Relevance: .2, Instructions: 156COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0b42d156d095c0c8d3820cbe925908e088e35afd34e89dfda98ee3dbc438002d
                                                          • Instruction ID: 35f08b029dca3930d5fa2b0b6c01b43a96c6d665c4325fb67e292ca134b71762
                                                          • Opcode Fuzzy Hash: 0b42d156d095c0c8d3820cbe925908e088e35afd34e89dfda98ee3dbc438002d
                                                          • Instruction Fuzzy Hash: BA516E34B501059FDB64DBBCE8A0B6E77F6FB88310F148469C40A9B745EE34AC52CBA1
                                                          Function 069953F8 Relevance: .1, Instructions: 133COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fb4eee9fa34cd76fa64b62582284f1a1dbbc7999aee7c0f900a67ba7116a1418
                                                          • Instruction ID: b2325e08f280d7dabe4b01bce4cbf432179c95ec52f9d4e0561ce169539384f9
                                                          • Opcode Fuzzy Hash: fb4eee9fa34cd76fa64b62582284f1a1dbbc7999aee7c0f900a67ba7116a1418
                                                          • Instruction Fuzzy Hash: 7F416D71E006098FDFB1CFADD880AAFF7F6EB84210F21492AD159D7A51D331E8558BA1
                                                          Function 0699DA9D Relevance: .1, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 10aca81ec3bc15f4ddc6641c06c2852638df99037f898fa5f379af43a8142f00
                                                          • Instruction ID: 2a9e69c37ed887357473071ad25acd9a3baed61f100a88569fe0105a902f9c56
                                                          • Opcode Fuzzy Hash: 10aca81ec3bc15f4ddc6641c06c2852638df99037f898fa5f379af43a8142f00
                                                          • Instruction Fuzzy Hash: C641B234E007099FDF64DF69C4906AEBBB6FF85300F204529E412EB740EB75984ACBA1
                                                          Function 069921D0 Relevance: .1, Instructions: 105COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ec66ae1dd271a7addb48655a77beca7f799cf0bd8c79853fd48927fa0d5122b8
                                                          • Instruction ID: fa6661653d60381d504e5f12e93e54623090e356d107acfea57a5cb9cfc49219
                                                          • Opcode Fuzzy Hash: ec66ae1dd271a7addb48655a77beca7f799cf0bd8c79853fd48927fa0d5122b8
                                                          • Instruction Fuzzy Hash: 5531EF30B202059FDF58ABB8C55476F3BAABF89640F204528D406DB385DF3ACD42CBA1
                                                          Function 0699D950 Relevance: .1, Instructions: 100COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 96b29b0127e348add3cb5509e98a511e4b062ed51c30688383aa7643107ed2e5
                                                          • Instruction ID: 62e1710a128e11ac690a61409280f09f36c0479fff8adc207b52149739dd08e9
                                                          • Opcode Fuzzy Hash: 96b29b0127e348add3cb5509e98a511e4b062ed51c30688383aa7643107ed2e5
                                                          • Instruction Fuzzy Hash: B131C630E1070A8FDF15DF68C890A9EB7B6FF85344F208929E405EB740E7B0E9468B91
                                                          Function 06992081 Relevance: .1, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d28cb5fd01a04f8fce330110e59802076da7d16ba28b2456eb37446505d375e8
                                                          • Instruction ID: e944b8a8788fc06825caaaec572bab8dffb2b6e4796d1327123681304fed22d4
                                                          • Opcode Fuzzy Hash: d28cb5fd01a04f8fce330110e59802076da7d16ba28b2456eb37446505d375e8
                                                          • Instruction Fuzzy Hash: AA319D34E102059FDB69CF68D8546AEB7F6FF89310F108529E902A7B40DB71AD82CB50
                                                          Function 06992090 Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fd812035cea443bae95844de2c1afe78787dccb4b59418bec6f3ae3ad324e1f3
                                                          • Instruction ID: 9fe0dc1bd1a7bf0e4b55107fc0c9f2d3580cce9c750e5bbba3529395a581a9d1
                                                          • Opcode Fuzzy Hash: fd812035cea443bae95844de2c1afe78787dccb4b59418bec6f3ae3ad324e1f3
                                                          • Instruction Fuzzy Hash: 6F316D34E14205AFDB59CF68D854A9EB7B6FF89300F208519E906A7740DB71AD81CB50
                                                          Function 06993A80 Relevance: .1, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0a09e0107e54c1707e4571d2331d0d22abeb90a16d8e158406c1789426ebf6b2
                                                          • Instruction ID: 31ab3c5ae492d4c7dfa2145e6f828d44eda159dfc2fece89f0a39a7699a4979e
                                                          • Opcode Fuzzy Hash: 0a09e0107e54c1707e4571d2331d0d22abeb90a16d8e158406c1789426ebf6b2
                                                          • Instruction Fuzzy Hash: 9C215A35F522159FDF40CFADE990AAEBBF5EB48710F108029E945E7391D734D8418BA4
                                                          Function 06993A90 Relevance: .1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b404b8cb4fad50d75b9dffa97d2312da684fe7cb99ac01cbcc733269f6617174
                                                          • Instruction ID: bae800e8a13e5a49d8053d764d44d182a5192fa36f3c487e9f2c82ce198037f3
                                                          • Opcode Fuzzy Hash: b404b8cb4fad50d75b9dffa97d2312da684fe7cb99ac01cbcc733269f6617174
                                                          • Instruction Fuzzy Hash: 54212675F126159FDB50CFADE980AAEBBF5FB48710F108029E905E7381E639DC418BA4
                                                          Function 010BD030 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2818953327.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_10bd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 39bf4eb98a3b271adb62bde7703c36e9e73592c3d7114008167450b8e26b5d2f
                                                          • Instruction ID: 9aa9d4ae2fce04a413eead14aea769a17ed1b422d6d276efa7dbc422c7892232
                                                          • Opcode Fuzzy Hash: 39bf4eb98a3b271adb62bde7703c36e9e73592c3d7114008167450b8e26b5d2f
                                                          • Instruction Fuzzy Hash: A1212271514304DFDB15DF94D9C0B66FBA1EB84318F20C5AEE8890B252C33AD847CB62
                                                          Function 06996D00 Relevance: .1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c2f01a4abb49e4a82bb819754a8b8d9dbd36b6acd8f751975937a0e02b27dcce
                                                          • Instruction ID: be36acf1cb6a2a2a8fb3ccab88d808c293c90e3abd6f09945d683ea12c5381c2
                                                          • Opcode Fuzzy Hash: c2f01a4abb49e4a82bb819754a8b8d9dbd36b6acd8f751975937a0e02b27dcce
                                                          • Instruction Fuzzy Hash: 9D21A234B201199FDF54DBADE8506AEB7BBEB84350F248426E405EB780DB35DC918BA0
                                                          Function 06993BA0 Relevance: .1, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0985f00ac0ff7e37fb51409fc6f1770e720f4296e337a6d5e7372383418a7cb7
                                                          • Instruction ID: 2ac6b744ca639279bc8cef384ff8ae4db0fea9a9adb226946ce53bb3b3ca022a
                                                          • Opcode Fuzzy Hash: 0985f00ac0ff7e37fb51409fc6f1770e720f4296e337a6d5e7372383418a7cb7
                                                          • Instruction Fuzzy Hash: 5A118B35B145288FDF649A6CD8246AE77EAFBC8310B104439D90AE7740EE69DC528BA0
                                                          Function 069941E2 Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f011974e7722a21e8f03e97fa47417d71e4af749d376f47464101dfaf57b3d4a
                                                          • Instruction ID: be84ef092a4ba0951a6ec0565165a1f278e9370a5267a07c5b400e170ba23aea
                                                          • Opcode Fuzzy Hash: f011974e7722a21e8f03e97fa47417d71e4af749d376f47464101dfaf57b3d4a
                                                          • Instruction Fuzzy Hash: 8201F130B041101FEB6796BC9810B2FA7DEEBCA720F20843AE10ACB791E965DC4343E1
                                                          Function 06993B8F Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cd2bb9ccd11c958be85f561a945414a85eb8149506d7d8f831f70fb67f05e74e
                                                          • Instruction ID: 4ba1117a5ba8032a563c8a6db321ddadc9c01911a268f3f73a965a82805b5bb3
                                                          • Opcode Fuzzy Hash: cd2bb9ccd11c958be85f561a945414a85eb8149506d7d8f831f70fb67f05e74e
                                                          • Instruction Fuzzy Hash: 15012631B141141FDF658AADDC146FF76EEABC4300F140039E405D7280EE55DC1187E1
                                                          Function 0699A2F0 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9ce07077a90aba21587ace2a80b58399bc8db2bca268980191c4dffec73db123
                                                          • Instruction ID: 58497eff0574cf6f03ff0cf41b9aff58d9464d9fc24c3591f810f098ceb11d72
                                                          • Opcode Fuzzy Hash: 9ce07077a90aba21587ace2a80b58399bc8db2bca268980191c4dffec73db123
                                                          • Instruction Fuzzy Hash: 6401D830B142105FDFA5967CE865B6F77EDE786354F20843AE40ACB381EA25DC4287D0
                                                          Function 06993859 Relevance: .1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2d4e598337af3379055bd3fe2b424ad5d4f3726cd6bae7cbc8a6cffad28768ce
                                                          • Instruction ID: 3b721d3963ba4b31b1c2b4df1197eb2aa4631e23233911807d4b8c48640d8c0e
                                                          • Opcode Fuzzy Hash: 2d4e598337af3379055bd3fe2b424ad5d4f3726cd6bae7cbc8a6cffad28768ce
                                                          • Instruction Fuzzy Hash: F821D3B5D01259AFCB10DF9AD885ADEFFB8FB48310F10812AE918A7200C375A955CFA5
                                                          Function 0699F171 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3a435198507d4be71ec349d029fab3c794e4fd0644977c3ed4ba34f0eaade1a9
                                                          • Instruction ID: 7cfb2f693de8c72d44a1c2eeefe61384c905ef1f66e08c783bbae173dd90a876
                                                          • Opcode Fuzzy Hash: 3a435198507d4be71ec349d029fab3c794e4fd0644977c3ed4ba34f0eaade1a9
                                                          • Instruction Fuzzy Hash: EE01BC75B001114FDF79CA6CD890B6EA7EAEBCA320F20852AE40ACB745DA65DC4247D0
                                                          Function 010BD02B Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2818953327.00000000010BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010BD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_10bd000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction ID: 8db021a16fe21fe55bb541f8bd710c00886ca965d71227bc4f3428b583fddd60
                                                          • Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction Fuzzy Hash: 7911BB75504280DFCB16CF54D5C0B15FFA2FB84318F28C6AAE8894B656C33AD44ACB62
                                                          Function 06993860 Relevance: .1, Instructions: 52COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1b4759f5f424c141d78a9f20458fb3bcc22ba73e16246f0923b433aabaf2aa7a
                                                          • Instruction ID: 803ed5976e6dbf4ea8807b4b965c4de7e033a0af8a98e84c4a6f1845ac7b1ac3
                                                          • Opcode Fuzzy Hash: 1b4759f5f424c141d78a9f20458fb3bcc22ba73e16246f0923b433aabaf2aa7a
                                                          • Instruction Fuzzy Hash: 0911B3B5D01259AFCB10DF9AD884ADEFBB8FB49310F10812AE918A7240D375A954CFA5
                                                          Function 069941F0 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 152677b5609e2a14de0903d089e52ff289a1de1b89e9377acef0757f25ee4871
                                                          • Instruction ID: 26677abc25087d5c6e367e52253ff4f29d6ee3bc4469b789f9bcfe1f4825e7e8
                                                          • Opcode Fuzzy Hash: 152677b5609e2a14de0903d089e52ff289a1de1b89e9377acef0757f25ee4871
                                                          • Instruction Fuzzy Hash: 0A016235B001111BDF6695AD945472FA3DEEBC9B60F208439E10AC7750DD65DC4343A1
                                                          Function 0699F180 Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fc33e036e274f32171faac83262613312f02443cadc8d09f9245095d0732cc9a
                                                          • Instruction ID: 3722e661d8589343b1d8da22e4c10f36bf46d446ebec5574d780ef40410bb044
                                                          • Opcode Fuzzy Hash: fc33e036e274f32171faac83262613312f02443cadc8d09f9245095d0732cc9a
                                                          • Instruction Fuzzy Hash: CE018C75B101115BDF75997DD860B2FA3DEEBCA720F208829E50ACB780EE65EC4247E1
                                                          Function 0699A300 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b48e9318e92e61b15172680c765d07ab74bf341469b0bbca05c3be66638d4978
                                                          • Instruction ID: c1b0ae38a2712ade0be4833b00cfbcceb9f87870d520692ad806567416b20489
                                                          • Opcode Fuzzy Hash: b48e9318e92e61b15172680c765d07ab74bf341469b0bbca05c3be66638d4978
                                                          • Instruction Fuzzy Hash: 7001A434B101145FDF65DA7CE455B1F77DEE789754F208839E50ACB780EA25EC418790
                                                          Function 06996461 Relevance: .0, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0fa090bd7ca4c3d1e62f6590c8f93cc1cef444cd67772f3e8ae3e7e168d5033e
                                                          • Instruction ID: 464e157e279ec7a72614302e2542ff088ea4fdec7dc30864f8c9dcacd367a708
                                                          • Opcode Fuzzy Hash: 0fa090bd7ca4c3d1e62f6590c8f93cc1cef444cd67772f3e8ae3e7e168d5033e
                                                          • Instruction Fuzzy Hash: 9CE09270E552086FFFA0CEFC8D55A9A776ED742204F3048A5D804CBA41E272DD118BB1
                                                          Function 069982DE Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000009.00000002.2832606325.0000000006990000.00000040.00000800.00020000.00000000.sdmp, Offset: 06990000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_9_2_6990000_HGhGAjCVw5.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fda300a4c461085e353d8cb0184664218fde2ac13ed79993e44b14d3566fa0a0
                                                          • Instruction ID: 92a2fbdb00f2d36496ec08fd7089cab086ba6dcfd2ca6e2099722dd8b490048f
                                                          • Opcode Fuzzy Hash: fda300a4c461085e353d8cb0184664218fde2ac13ed79993e44b14d3566fa0a0
                                                          • Instruction Fuzzy Hash: AFF0A036F24200CFEF644DBDEB8227873A8EB06251B640D6ACD01C3941D239DD90CAB0

                                                          Execution Graph

                                                          Execution Coverage:10.3%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:0%
                                                          Total number of Nodes:105
                                                          Total number of Limit Nodes:6
                                                          execution_graph 22684 74c71ca 22688 74c7cb8 22684->22688 22691 74c7cc0 22684->22691 22685 74c71de 22689 74c7d08 VirtualProtect 22688->22689 22690 74c7d42 22689->22690 22690->22685 22692 74c7d08 VirtualProtect 22691->22692 22693 74c7d42 22692->22693 22693->22685 22694 2ce4668 22695 2ce467a 22694->22695 22696 2ce4686 22695->22696 22700 2ce4779 22695->22700 22705 2ce3e28 22696->22705 22698 2ce46a5 22701 2ce479d 22700->22701 22709 2ce4878 22701->22709 22713 2ce4888 22701->22713 22706 2ce3e33 22705->22706 22721 2ce5c68 22706->22721 22708 2ce6ff6 22708->22698 22711 2ce48af 22709->22711 22710 2ce498c 22710->22710 22711->22710 22717 2ce44b0 22711->22717 22715 2ce48af 22713->22715 22714 2ce498c 22714->22714 22715->22714 22716 2ce44b0 CreateActCtxA 22715->22716 22716->22714 22718 2ce5918 CreateActCtxA 22717->22718 22720 2ce59cf 22718->22720 22722 2ce5c73 22721->22722 22725 2ce5c88 22722->22725 22724 2ce7195 22724->22708 22726 2ce5c93 22725->22726 22729 2ce5cb8 22726->22729 22728 2ce727a 22728->22724 22730 2ce5cc3 22729->22730 22733 2ce5ce8 22730->22733 22732 2ce736d 22732->22728 22734 2ce5cf3 22733->22734 22735 2ce866b 22734->22735 22740 2cead19 22734->22740 22736 2ce86a9 22735->22736 22744 2cece10 22735->22744 22751 2cece00 22735->22751 22736->22732 22759 2cead50 22740->22759 22762 2cead41 22740->22762 22741 2cead2e 22741->22735 22745 2cece31 22744->22745 22746 2cece55 22745->22746 22771 2cecfbf 22745->22771 22775 2cecfb0 22745->22775 22779 2cecfc0 22745->22779 22783 2cecf7d 22745->22783 22746->22736 22752 2cece06 22751->22752 22753 2cecdb4 22751->22753 22754 2cece55 22752->22754 22755 2cecfbf GetModuleHandleW 22752->22755 22756 2cecf7d GetModuleHandleW 22752->22756 22757 2cecfc0 GetModuleHandleW 22752->22757 22758 2cecfb0 GetModuleHandleW 22752->22758 22753->22736 22754->22736 22755->22754 22756->22754 22757->22754 22758->22754 22766 2ceae48 22759->22766 22760 2cead5f 22760->22741 22763 2cead50 22762->22763 22765 2ceae48 GetModuleHandleW 22763->22765 22764 2cead5f 22764->22741 22765->22764 22767 2ceae59 22766->22767 22768 2ceae7c 22766->22768 22767->22768 22769 2ceb080 GetModuleHandleW 22767->22769 22768->22760 22770 2ceb0ad 22769->22770 22770->22760 22773 2cecfcd 22771->22773 22772 2ced007 22772->22746 22773->22772 22787 2ceb820 22773->22787 22776 2cecfb5 22775->22776 22777 2ceb820 GetModuleHandleW 22776->22777 22778 2ced007 22776->22778 22777->22778 22778->22746 22781 2cecfcd 22779->22781 22780 2ced007 22780->22746 22781->22780 22782 2ceb820 GetModuleHandleW 22781->22782 22782->22780 22784 2cecfb5 22783->22784 22785 2ced007 22784->22785 22786 2ceb820 GetModuleHandleW 22784->22786 22785->22746 22786->22785 22788 2ceb82b 22787->22788 22790 2cedd18 22788->22790 22791 2ced124 22788->22791 22792 2ced12f 22791->22792 22793 2ce5ce8 GetModuleHandleW 22792->22793 22794 2cedd87 22793->22794 22794->22790 22804 2ced4d8 22805 2ced51e 22804->22805 22809 2ced6a8 22805->22809 22812 2ced6b8 22805->22812 22806 2ced60b 22815 2ceb830 22809->22815 22813 2ced6e6 22812->22813 22814 2ceb830 DuplicateHandle 22812->22814 22813->22806 22814->22813 22816 2ced720 DuplicateHandle 22815->22816 22817 2ced6e6 22816->22817 22817->22806 22818 74c59b4 22820 74c7cb8 VirtualProtect 22818->22820 22821 74c7cc0 VirtualProtect 22818->22821 22819 74c59e5 22820->22819 22821->22819 22799 74c66c1 22801 74c66c4 22799->22801 22800 74c6729 22801->22800 22802 74c7cb8 VirtualProtect 22801->22802 22803 74c7cc0 VirtualProtect 22801->22803 22802->22801 22803->22801

                                                          Executed Functions

                                                          Function 02CEAE48 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 232 2ceae48-2ceae57 233 2ceae59-2ceae66 call 2cea1a0 232->233 234 2ceae83-2ceae87 232->234 241 2ceae7c 233->241 242 2ceae68 233->242 235 2ceae9b-2ceaedc 234->235 236 2ceae89-2ceae93 234->236 243 2ceaede-2ceaee6 235->243 244 2ceaee9-2ceaef7 235->244 236->235 241->234 287 2ceae6e call 2ceb0e0 242->287 288 2ceae6e call 2ceb0d1 242->288 243->244 245 2ceaf1b-2ceaf1d 244->245 246 2ceaef9-2ceaefe 244->246 249 2ceaf20-2ceaf27 245->249 250 2ceaf09 246->250 251 2ceaf00-2ceaf07 call 2cea1ac 246->251 247 2ceae74-2ceae76 247->241 248 2ceafb8-2ceb078 247->248 282 2ceb07a-2ceb07d 248->282 283 2ceb080-2ceb0ab GetModuleHandleW 248->283 253 2ceaf29-2ceaf31 249->253 254 2ceaf34-2ceaf3b 249->254 252 2ceaf0b-2ceaf19 250->252 251->252 252->249 253->254 256 2ceaf3d-2ceaf45 254->256 257 2ceaf48-2ceaf51 call 2cea1bc 254->257 256->257 263 2ceaf5e-2ceaf63 257->263 264 2ceaf53-2ceaf5b 257->264 265 2ceaf65-2ceaf6c 263->265 266 2ceaf81-2ceaf8e 263->266 264->263 265->266 268 2ceaf6e-2ceaf7e call 2cea1cc call 2cea1dc 265->268 272 2ceaf90-2ceafae 266->272 273 2ceafb1-2ceafb7 266->273 268->266 272->273 282->283 284 2ceb0ad-2ceb0b3 283->284 285 2ceb0b4-2ceb0c8 283->285 284->285 287->247 288->247
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 02CEB09E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID: J3
                                                          • API String ID: 4139908857-2790555919
                                                          • Opcode ID: 7840bf5feef57471e76f50213d6953d5e336692ee04d5e923610580b792e1dbe
                                                          • Instruction ID: dd1d91e3f555adacb7c40d6bc85eaaad1cd96e358f914c4675c05da30e87c6cc
                                                          • Opcode Fuzzy Hash: 7840bf5feef57471e76f50213d6953d5e336692ee04d5e923610580b792e1dbe
                                                          • Instruction Fuzzy Hash: 967164B0A00B058FDB28DF2AD44475ABBF1BF88304F00892DE48AD7A50EB75E945CF95
                                                          Function 02CE44B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 289 2ce44b0-2ce59d9 CreateActCtxA 292 2ce59db-2ce59e1 289->292 293 2ce59e2-2ce5a3c 289->293 292->293 300 2ce5a3e-2ce5a41 293->300 301 2ce5a4b-2ce5a4f 293->301 300->301 302 2ce5a60-2ce5a90 301->302 303 2ce5a51-2ce5a5d 301->303 307 2ce5a42-2ce5a4a 302->307 308 2ce5a92-2ce5b14 302->308 303->302 307->301 311 2ce59cf-2ce59d9 307->311 311->292 311->293
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 02CE59C9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID: J3
                                                          • API String ID: 2289755597-2790555919
                                                          • Opcode ID: b85ce673e8bf7ae9c37c415ccc4cd2cb5501f7c169d1ad8477009ee6d39c593e
                                                          • Instruction ID: 77eeb372d1e03ccf9e13b434c56506d2817503c1ae03d2a83b51f741a66b946f
                                                          • Opcode Fuzzy Hash: b85ce673e8bf7ae9c37c415ccc4cd2cb5501f7c169d1ad8477009ee6d39c593e
                                                          • Instruction Fuzzy Hash: D241A271D00719CBEB24DFA9C884BDDBBB5BF49304F60805AD409AB251DBB56986CF90
                                                          Function 02CE590D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 312 2ce590d-2ce59d9 CreateActCtxA 314 2ce59db-2ce59e1 312->314 315 2ce59e2-2ce5a3c 312->315 314->315 322 2ce5a3e-2ce5a41 315->322 323 2ce5a4b-2ce5a4f 315->323 322->323 324 2ce5a60-2ce5a90 323->324 325 2ce5a51-2ce5a5d 323->325 329 2ce5a42-2ce5a4a 324->329 330 2ce5a92-2ce5b14 324->330 325->324 329->323 333 2ce59cf-2ce59d9 329->333 333->314 333->315
                                                          APIs
                                                          • CreateActCtxA.KERNEL32(?), ref: 02CE59C9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: Create
                                                          • String ID: J3
                                                          • API String ID: 2289755597-2790555919
                                                          • Opcode ID: ea0619df093cf0604c03b65bc2c61e745aec25484b7e9a332613d34a448b23d2
                                                          • Instruction ID: 68a6f63a49262fd05842cefbf97e57aaa3b882f7d5f6100d3735b0104e122621
                                                          • Opcode Fuzzy Hash: ea0619df093cf0604c03b65bc2c61e745aec25484b7e9a332613d34a448b23d2
                                                          • Instruction Fuzzy Hash: 6741C470D00719CFEB24CFA9C8847DDBBB5BF49304F60806AD409AB251DB756986CF50
                                                          Function 02CEB830 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 334 2ceb830-2ced7b4 DuplicateHandle 336 2ced7bd-2ced7da 334->336 337 2ced7b6-2ced7bc 334->337 337->336
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CED6E6,?,?,?,?,?), ref: 02CED7A7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID: J3
                                                          • API String ID: 3793708945-2790555919
                                                          • Opcode ID: eedf9361c123c4c92f65b6e2cbe2d8e2fe20e8386da347e30e930d71fc0ba6c7
                                                          • Instruction ID: d64b25f7146f795e81d67d0b3c5edc7c5406ee02ee32b2c24ae21ff850ea0c26
                                                          • Opcode Fuzzy Hash: eedf9361c123c4c92f65b6e2cbe2d8e2fe20e8386da347e30e930d71fc0ba6c7
                                                          • Instruction Fuzzy Hash: 3221E4B5900348AFDB10CF9AD985BDEFBF9EB48310F14841AE919A3310D378A950CFA4
                                                          Function 02CED719 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 340 2ced719-2ced7b4 DuplicateHandle 341 2ced7bd-2ced7da 340->341 342 2ced7b6-2ced7bc 340->342 342->341
                                                          APIs
                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CED6E6,?,?,?,?,?), ref: 02CED7A7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: DuplicateHandle
                                                          • String ID: J3
                                                          • API String ID: 3793708945-2790555919
                                                          • Opcode ID: 7695a45b5f461d7cebbfe46c93cdabf1b145594dd23d2d7d030cfa447e0a4c61
                                                          • Instruction ID: e9bbf9ac086353cc29f2aa4de157a0934bc4fd3a42cd705f1ac8349594f82283
                                                          • Opcode Fuzzy Hash: 7695a45b5f461d7cebbfe46c93cdabf1b145594dd23d2d7d030cfa447e0a4c61
                                                          • Instruction Fuzzy Hash: 0721E2B59003489FDB10CFAAD585ADEBBF5EB48310F14841AE919B3211D378AA54CF64
                                                          Function 074C7CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 350 74c7cc0-74c7d40 VirtualProtect 352 74c7d49-74c7d6a 350->352 353 74c7d42-74c7d48 350->353 353->352
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(?,?,?,?), ref: 074C7D33
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1643739877.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_74c0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID: J3
                                                          • API String ID: 544645111-2790555919
                                                          • Opcode ID: 724fa5cb14a2b5fbcc8245f4fd2581785fb04e6c990feeecfe7523303aad79f5
                                                          • Instruction ID: c395473b9d4cecf248dd75b68b9734315d6ad77117fc1fdaaad8a99ecb2b55a6
                                                          • Opcode Fuzzy Hash: 724fa5cb14a2b5fbcc8245f4fd2581785fb04e6c990feeecfe7523303aad79f5
                                                          • Instruction Fuzzy Hash: 4D21E7B5D002499FDB10CF9AC484BDEFBF4FB48310F10842AE958A7250D378A545CFA5
                                                          Function 074C7CB8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 345 74c7cb8-74c7d40 VirtualProtect 347 74c7d49-74c7d6a 345->347 348 74c7d42-74c7d48 345->348 348->347
                                                          APIs
                                                          • VirtualProtect.KERNELBASE(?,?,?,?), ref: 074C7D33
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1643739877.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_74c0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID: J3
                                                          • API String ID: 544645111-2790555919
                                                          • Opcode ID: 7dd798cb50501915d2453d440e79005592175b670cc916a3193291bb86a63b7f
                                                          • Instruction ID: e32f11c26e1786fe4320ca72bb142218d909e4e0ceed73037995d836ffd7f5eb
                                                          • Opcode Fuzzy Hash: 7dd798cb50501915d2453d440e79005592175b670cc916a3193291bb86a63b7f
                                                          • Instruction Fuzzy Hash: FC21C4B5D002599FDB10DF9AC484BEEBBF4FB48310F10842AE968A7650D378A645CFA5
                                                          Function 02CEB038 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 355 2ceb038-2ceb078 356 2ceb07a-2ceb07d 355->356 357 2ceb080-2ceb0ab GetModuleHandleW 355->357 356->357 358 2ceb0ad-2ceb0b3 357->358 359 2ceb0b4-2ceb0c8 357->359 358->359
                                                          APIs
                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 02CEB09E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1637612369.0000000002CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CE0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_2ce0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: HandleModule
                                                          • String ID: J3
                                                          • API String ID: 4139908857-2790555919
                                                          • Opcode ID: 13833e9cd69433d76392e6066ea783e6189afd39d200af33f86caf05a5c212cf
                                                          • Instruction ID: 340c4355fa81f94d0cd6c820a5c9381b221d36e5ee4432bae61893462320136d
                                                          • Opcode Fuzzy Hash: 13833e9cd69433d76392e6066ea783e6189afd39d200af33f86caf05a5c212cf
                                                          • Instruction Fuzzy Hash: 5311E3B5D002498FDB20CF9AC444BDEFBF5FB88314F10841AD929A7610D379A645CFA5
                                                          Function 0111D3D8 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635624821.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_111d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7957a6c3dd06fcb227137bc6085bf104fc3f18ce7ba721b09dee1de4b557bff0
                                                          • Instruction ID: e8c912dbf7ea8e2b19498ebbc041fc6267e40f89338b358140fd4cc646d50193
                                                          • Opcode Fuzzy Hash: 7957a6c3dd06fcb227137bc6085bf104fc3f18ce7ba721b09dee1de4b557bff0
                                                          • Instruction Fuzzy Hash: A1213671540204DFDF09DF84E9C4B56FB65FB88314F20C179E8090BA5AC33AE446CBA2
                                                          Function 0111D4C4 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635624821.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_111d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d0341854405bd894caabd77f7b05e6211969fd85102b958fce4969de7094fea3
                                                          • Instruction ID: e14c242fb6b21eb4516a8be65075eb90a625e8ed793750d16e5e5ecd85f559de
                                                          • Opcode Fuzzy Hash: d0341854405bd894caabd77f7b05e6211969fd85102b958fce4969de7094fea3
                                                          • Instruction Fuzzy Hash: 2F21F171500240DFDF19DF54E9C8B26FF75FB88218F20C579E8090B65AC336D456CAA2
                                                          Function 0112D1D4 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635735849.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_112d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 41a900dcf44c12347925e027871527eb84e8d588eb5e2ea38ab0c6d5903ef98a
                                                          • Instruction ID: 88bebfe7696dc3f5bb13b068da542b3cc9723f7d536b5ed128d429041fa75bf1
                                                          • Opcode Fuzzy Hash: 41a900dcf44c12347925e027871527eb84e8d588eb5e2ea38ab0c6d5903ef98a
                                                          • Instruction Fuzzy Hash: B021F571504304DFDF19DF94E5C0B15BB65FB85324F20C56DE8094B252C336D456CA62
                                                          Function 0112D01C Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635735849.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_112d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3c26919b9f2ee17b68acd416fcda21d4856ec628601318f940a81c009ee27fc9
                                                          • Instruction ID: 4ae153f02ac2719f9c93634ecb5825a773b3a998d142896bc5653adeba5a79fd
                                                          • Opcode Fuzzy Hash: 3c26919b9f2ee17b68acd416fcda21d4856ec628601318f940a81c009ee27fc9
                                                          • Instruction Fuzzy Hash: 5C212271604340DFDF19DF94E8C0B16BB61EB88354F20C5ADD80A0B2A2C33AD867CB66
                                                          Function 0112D006 Relevance: .1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635735849.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_112d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 25215ccecbfcf8e89c0c1da52051319eb818805debcc56db814d89008e916d9c
                                                          • Instruction ID: e67d21c89c78726689d4953297ce72b38aae7efabe3c2852b3f44e83df96d093
                                                          • Opcode Fuzzy Hash: 25215ccecbfcf8e89c0c1da52051319eb818805debcc56db814d89008e916d9c
                                                          • Instruction Fuzzy Hash: 162192755083809FCB07CF64D994715BF71EF4A214F28C5DAD8898F2A7C33A9816CB62
                                                          Function 0111D3D3 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635624821.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_111d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction ID: 3a8736a64acf9519a1361f73b4dad718efce8760dcc3c1da1f10d42f31f6dcbf
                                                          • Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction Fuzzy Hash: F111CD72404240CFCF1ACF44D5C4B56BF61FB88224F2486A9D8090BA5AC33AE456CBA2
                                                          Function 0111D4BF Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635624821.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_111d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction ID: 8e8593bbab0a7338200c45fbeab736a8497e638f29c6719cabc496223315864e
                                                          • Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
                                                          • Instruction Fuzzy Hash: 6E119D76504280CFCF1ACF54E5C4B16BF71FB88214F2486A9D8490B65AC336D456CBA2
                                                          Function 0112D1CF Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000A.00000002.1635735849.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_10_2_112d000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction ID: 191554fa6aed78b1667ef0c057cb10f91aae3f3849e83936e26131b87d121fcf
                                                          • Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction Fuzzy Hash: 8411BB75504280DFDB0ACF54D5C0B15BFA1FB85224F24C6A9D8494B296C33AD41ACB62

                                                          Execution Graph

                                                          Execution Coverage:11.9%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:0%
                                                          Total number of Nodes:18
                                                          Total number of Limit Nodes:5
                                                          execution_graph 25430 1710b4d 25431 1710b55 25430->25431 25433 171084e 25430->25433 25432 171091b 25433->25430 25433->25432 25435 1711380 25433->25435 25437 1711396 25435->25437 25436 1711480 25436->25433 25437->25436 25439 1717eb0 25437->25439 25440 1717eba 25439->25440 25441 1717ed4 25440->25441 25444 6dbfa09 25440->25444 25448 6dbfa18 25440->25448 25441->25437 25446 6dbfa2d 25444->25446 25445 6dbfc42 25445->25441 25446->25445 25447 6dbfc58 GlobalMemoryStatusEx GlobalMemoryStatusEx 25446->25447 25447->25446 25449 6dbfa2d 25448->25449 25450 6dbfc42 25449->25450 25451 6dbfc58 GlobalMemoryStatusEx GlobalMemoryStatusEx 25449->25451 25450->25441 25451->25449

                                                          Executed Functions

                                                          Function 06DB234B Relevance: 1.0, Instructions: 1009COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 69f03ee18ff3285ad3030457ba59d607115b8b85a558265142edf223a6834661
                                                          • Instruction ID: e39a95e0beea936830d5b7b2bfef84a1170945c07d2cbcb2779eec72c256d1f8
                                                          • Opcode Fuzzy Hash: 69f03ee18ff3285ad3030457ba59d607115b8b85a558265142edf223a6834661
                                                          • Instruction Fuzzy Hash: 1F924631E00204CFDB64DB68C584AADBBF2FF49314F5484A9D44AAB369DB35ED81CB81
                                                          Function 06DB65E0 Relevance: .8, Instructions: 812COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8a4f82f41dec70b28860f525600825254bafb63164899fafb0659896bee9addf
                                                          • Instruction ID: 04a120d7caad0f657b4a8bf1cabf62fbcf737292a1e63fc94134b507f43c93af
                                                          • Opcode Fuzzy Hash: 8a4f82f41dec70b28860f525600825254bafb63164899fafb0659896bee9addf
                                                          • Instruction Fuzzy Hash: 13628934B00245DFDB64DB68D594AADB7B2FF88310F149469E406DB398EB76EC81CB90
                                                          Function 06DB5588 Relevance: .6, Instructions: 607COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 2029 6db5588-6db55a5 2030 6db55a7-6db55aa 2029->2030 2031 6db55b0-6db55b3 2030->2031 2032 6db56f5-6db56fb 2030->2032 2035 6db55c2-6db55c5 2031->2035 2036 6db55b5-6db55bb 2031->2036 2033 6db56fd 2032->2033 2034 6db5712-6db571c 2032->2034 2037 6db5702-6db5705 2033->2037 2046 6db5723-6db5725 2034->2046 2040 6db55e2-6db55e5 2035->2040 2041 6db55c7-6db55dd 2035->2041 2038 6db560a-6db5610 2036->2038 2039 6db55bd 2036->2039 2044 6db570d-6db5710 2037->2044 2045 6db5707-6db5708 2037->2045 2042 6db5763-6db5793 2038->2042 2043 6db5616-6db561e 2038->2043 2039->2035 2047 6db55f8-6db55fb 2040->2047 2048 6db55e7-6db55ed 2040->2048 2041->2040 2065 6db579d-6db57a0 2042->2065 2043->2042 2053 6db5624-6db5631 2043->2053 2044->2034 2054 6db572a-6db572d 2044->2054 2045->2044 2046->2054 2051 6db55fd-6db5600 2047->2051 2052 6db5605-6db5608 2047->2052 2049 6db568a-6db568d 2048->2049 2050 6db55f3 2048->2050 2056 6db5692-6db5695 2049->2056 2050->2047 2051->2052 2052->2038 2057 6db5640-6db5643 2052->2057 2053->2042 2059 6db5637-6db563b 2053->2059 2060 6db572f-6db573e 2054->2060 2061 6db5743-6db5745 2054->2061 2056->2036 2064 6db569b-6db569e 2056->2064 2066 6db5669-6db566c 2057->2066 2067 6db5645-6db5664 2057->2067 2059->2057 2060->2061 2062 6db574c-6db574f 2061->2062 2063 6db5747 2061->2063 2062->2030 2068 6db5755-6db5762 2062->2068 2063->2062 2069 6db56af-6db56b2 2064->2069 2070 6db56a0-6db56a4 2064->2070 2071 6db57c2-6db57c5 2065->2071 2072 6db57a2-6db57a6 2065->2072 2074 6db566e-6db5680 2066->2074 2075 6db5685-6db5688 2066->2075 2067->2066 2077 6db56be-6db56c1 2069->2077 2078 6db56b4-6db56bd 2069->2078 2070->2068 2076 6db56aa 2070->2076 2082 6db57dd-6db57e0 2071->2082 2083 6db57c7-6db57d8 2071->2083 2079 6db588e-6db5898 2072->2079 2080 6db57ac-6db57b4 2072->2080 2074->2075 2075->2049 2075->2056 2076->2069 2087 6db56c3-6db56d0 2077->2087 2088 6db56d5-6db56d8 2077->2088 2104 6db589a-6db58c1 2079->2104 2105 6db58c3-6db58cd 2079->2105 2080->2079 2089 6db57ba-6db57bd 2080->2089 2085 6db57e2-6db57e9 2082->2085 2086 6db57f4-6db57f7 2082->2086 2083->2082 2091 6db57ef 2085->2091 2092 6db5886-6db588d 2085->2092 2093 6db5819-6db581c 2086->2093 2094 6db57f9-6db57fd 2086->2094 2087->2088 2097 6db56da-6db56dc 2088->2097 2098 6db56df-6db56e2 2088->2098 2089->2071 2091->2086 2102 6db581e-6db5825 2093->2102 2103 6db5826-6db5829 2093->2103 2094->2079 2101 6db5803-6db580b 2094->2101 2097->2098 2099 6db56f0-6db56f3 2098->2099 2100 6db56e4-6db56eb 2098->2100 2099->2032 2099->2037 2100->2099 2101->2079 2107 6db5811-6db5814 2101->2107 2108 6db582b-6db582f 2103->2108 2109 6db5843-6db5846 2103->2109 2104->2105 2110 6db58ce-6db58d1 2105->2110 2107->2093 2108->2079 2111 6db5831-6db5839 2108->2111 2112 6db5848-6db584c 2109->2112 2113 6db5860-6db5863 2109->2113 2114 6db58db-6db58de 2110->2114 2115 6db58d3-6db58da 2110->2115 2111->2079 2118 6db583b-6db583e 2111->2118 2112->2079 2119 6db584e-6db5856 2112->2119 2116 6db5865-6db586f 2113->2116 2117 6db5874-6db5876 2113->2117 2120 6db58f8-6db58fb 2114->2120 2121 6db58e0-6db58f1 2114->2121 2115->2114 2116->2117 2122 6db5878 2117->2122 2123 6db587d-6db5880 2117->2123 2118->2109 2119->2079 2126 6db5858-6db585b 2119->2126 2124 6db58fd-6db590e 2120->2124 2125 6db5915-6db5918 2120->2125 2121->2124 2131 6db58f3 2121->2131 2122->2123 2123->2065 2123->2092 2136 6db5930-6db5937 2124->2136 2137 6db5910 2124->2137 2129 6db591a-6db591d 2125->2129 2130 6db5960-6db5af4 2125->2130 2126->2113 2133 6db592b-6db592e 2129->2133 2134 6db591f-6db5926 2129->2134 2180 6db5afa-6db5b01 2130->2180 2181 6db5c2d-6db5c40 2130->2181 2131->2120 2133->2136 2138 6db593c-6db593f 2133->2138 2134->2133 2136->2138 2137->2125 2139 6db5941-6db5954 2138->2139 2140 6db5957-6db595a 2138->2140 2140->2130 2141 6db5c43-6db5c46 2140->2141 2144 6db5c48-6db5c59 2141->2144 2145 6db5c64-6db5c67 2141->2145 2144->2136 2151 6db5c5f 2144->2151 2146 6db5c69-6db5c7a 2145->2146 2147 6db5c85-6db5c88 2145->2147 2146->2136 2156 6db5c80 2146->2156 2147->2130 2150 6db5c8e-6db5c91 2147->2150 2153 6db5caf-6db5cb1 2150->2153 2154 6db5c93-6db5ca4 2150->2154 2151->2145 2157 6db5cb8-6db5cbb 2153->2157 2158 6db5cb3 2153->2158 2154->2139 2162 6db5caa 2154->2162 2156->2147 2157->2110 2159 6db5cc1-6db5cca 2157->2159 2158->2157 2162->2153 2182 6db5b07-6db5b3a 2180->2182 2183 6db5bb5-6db5bbc 2180->2183 2194 6db5b3f-6db5b80 2182->2194 2195 6db5b3c 2182->2195 2183->2181 2184 6db5bbe-6db5bf1 2183->2184 2196 6db5bf3 2184->2196 2197 6db5bf6-6db5c23 2184->2197 2205 6db5b98-6db5b9f 2194->2205 2206 6db5b82-6db5b93 2194->2206 2195->2194 2196->2197 2197->2159 2208 6db5ba7-6db5ba9 2205->2208 2206->2159 2208->2159
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0da78c45cfe8a04ed5d899b732554636a64b3522502b89bfba47f3f9e0957eeb
                                                          • Instruction ID: 052f8bfb8c6610b2552a8d30144aa5fa6d6d7a2d64b25f06c58b643073d1fffe
                                                          • Opcode Fuzzy Hash: 0da78c45cfe8a04ed5d899b732554636a64b3522502b89bfba47f3f9e0957eeb
                                                          • Instruction Fuzzy Hash: 57229C35E00204DFDF65CF68D8906EEBBB2EF89310F248469D456AB349DA35DC45CB90
                                                          Function 06DBB20F Relevance: .6, Instructions: 589COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b9f7ca5af4909a513583c630e8fb73293a7fcfb89c8715629bbbfdd3573f9b30
                                                          • Instruction ID: 6de49e985ce52537c2ecc6c477c6e159653e770b469f35f568e085aa71c88723
                                                          • Opcode Fuzzy Hash: b9f7ca5af4909a513583c630e8fb73293a7fcfb89c8715629bbbfdd3573f9b30
                                                          • Instruction Fuzzy Hash: A7224C30E10209DFEF64CB59D4807EEB7A6FB49310F24942AE406EB395DE79DC818B91
                                                          Function 06DB3040 Relevance: .5, Instructions: 545COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 2999 6db3040-6db3061 3000 6db3063-6db3066 2999->3000 3001 6db306c-6db308b 3000->3001 3002 6db3807-6db380a 3000->3002 3012 6db308d-6db3090 3001->3012 3013 6db30a4-6db30ae 3001->3013 3003 6db380c-6db382b 3002->3003 3004 6db3830-6db3832 3002->3004 3003->3004 3006 6db3839-6db383c 3004->3006 3007 6db3834 3004->3007 3006->3000 3009 6db3842-6db384b 3006->3009 3007->3006 3012->3013 3014 6db3092-6db30a2 3012->3014 3017 6db30b4-6db30c3 3013->3017 3014->3017 3125 6db30c5 call 6db3859 3017->3125 3126 6db30c5 call 6db3860 3017->3126 3018 6db30ca-6db30cf 3019 6db30dc-6db33b9 3018->3019 3020 6db30d1-6db30d7 3018->3020 3041 6db37f9-6db3806 3019->3041 3042 6db33bf-6db346e 3019->3042 3020->3009 3051 6db3470-6db3495 3042->3051 3052 6db3497 3042->3052 3054 6db34a0-6db34b3 3051->3054 3052->3054 3056 6db34b9-6db34db 3054->3056 3057 6db37e0-6db37ec 3054->3057 3056->3057 3060 6db34e1-6db34eb 3056->3060 3057->3042 3058 6db37f2 3057->3058 3058->3041 3060->3057 3061 6db34f1-6db34fc 3060->3061 3061->3057 3062 6db3502-6db35d8 3061->3062 3074 6db35da-6db35dc 3062->3074 3075 6db35e6-6db3616 3062->3075 3074->3075 3079 6db3618-6db361a 3075->3079 3080 6db3624-6db3630 3075->3080 3079->3080 3081 6db3632-6db3636 3080->3081 3082 6db3690-6db3694 3080->3082 3081->3082 3085 6db3638-6db3662 3081->3085 3083 6db369a-6db36d6 3082->3083 3084 6db37d1-6db37da 3082->3084 3096 6db36d8-6db36da 3083->3096 3097 6db36e4-6db36f2 3083->3097 3084->3057 3084->3062 3092 6db3670-6db368d 3085->3092 3093 6db3664-6db3666 3085->3093 3092->3082 3093->3092 3096->3097 3099 6db3709-6db3714 3097->3099 3100 6db36f4-6db36ff 3097->3100 3104 6db372c-6db373d 3099->3104 3105 6db3716-6db371c 3099->3105 3100->3099 3103 6db3701 3100->3103 3103->3099 3109 6db373f-6db3745 3104->3109 3110 6db3755-6db3761 3104->3110 3106 6db371e 3105->3106 3107 6db3720-6db3722 3105->3107 3106->3104 3107->3104 3111 6db3749-6db374b 3109->3111 3112 6db3747 3109->3112 3114 6db3779-6db37ca 3110->3114 3115 6db3763-6db3769 3110->3115 3111->3110 3112->3110 3114->3084 3116 6db376b 3115->3116 3117 6db376d-6db376f 3115->3117 3116->3114 3117->3114 3125->3018 3126->3018
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2f327c69fc2b57e0fb4d819a78c15c23b4abcc1d2fd7c60722e504540cfa6466
                                                          • Instruction ID: d83051aae93087643623f2d1fde31d68be98f4c579558d50a0a735cb79b1ffb4
                                                          • Opcode Fuzzy Hash: 2f327c69fc2b57e0fb4d819a78c15c23b4abcc1d2fd7c60722e504540cfa6466
                                                          • Instruction Fuzzy Hash: 63324D30E10619DFCB24DF79C89469DB7B2FFD9300F21966AD40AA7214EB74AD85CB90
                                                          Function 06DB7D68 Relevance: .5, Instructions: 476COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 3127 6db7d68-6db7d86 3128 6db7d88-6db7d8b 3127->3128 3129 6db7d8d-6db7d9b 3128->3129 3130 6db7da2-6db7da5 3128->3130 3138 6db7e0e-6db7e24 3129->3138 3139 6db7d9d 3129->3139 3131 6db7da7-6db7dc1 3130->3131 3132 6db7dc6-6db7dc9 3130->3132 3131->3132 3133 6db7dcb-6db7dd5 3132->3133 3134 6db7dd6-6db7dd9 3132->3134 3136 6db7ddb-6db7df7 3134->3136 3137 6db7dfc-6db7dfe 3134->3137 3136->3137 3141 6db7e00 3137->3141 3142 6db7e05-6db7e08 3137->3142 3146 6db7e2a-6db7e33 3138->3146 3147 6db803f-6db8049 3138->3147 3139->3130 3141->3142 3142->3128 3142->3138 3149 6db804a-6db807f 3146->3149 3150 6db7e39-6db7e56 3146->3150 3153 6db8081-6db8084 3149->3153 3157 6db802c-6db8039 3150->3157 3158 6db7e5c-6db7e84 3150->3158 3155 6db80a7-6db80aa 3153->3155 3156 6db8086-6db80a2 3153->3156 3159 6db82df-6db82e2 3155->3159 3160 6db80b0-6db80bf 3155->3160 3156->3155 3157->3146 3157->3147 3158->3157 3177 6db7e8a-6db7e93 3158->3177 3162 6db82e8-6db82f4 3159->3162 3163 6db838d-6db838f 3159->3163 3171 6db80de-6db8122 3160->3171 3172 6db80c1-6db80dc 3160->3172 3170 6db82ff-6db8301 3162->3170 3164 6db8391 3163->3164 3165 6db8396-6db8399 3163->3165 3164->3165 3165->3153 3168 6db839f-6db83a8 3165->3168 3174 6db8319-6db831d 3170->3174 3175 6db8303-6db8309 3170->3175 3184 6db8128-6db8139 3171->3184 3185 6db82b3-6db82c9 3171->3185 3172->3171 3180 6db832b 3174->3180 3181 6db831f-6db8329 3174->3181 3178 6db830b 3175->3178 3179 6db830d-6db830f 3175->3179 3177->3149 3186 6db7e99-6db7eb5 3177->3186 3178->3174 3179->3174 3183 6db8330-6db8332 3180->3183 3181->3183 3188 6db8343-6db837c 3183->3188 3189 6db8334-6db8337 3183->3189 3194 6db813f-6db815c 3184->3194 3195 6db829e-6db82ad 3184->3195 3185->3159 3197 6db7ebb-6db7ee5 3186->3197 3198 6db801a-6db8026 3186->3198 3188->3160 3212 6db8382-6db838c 3188->3212 3189->3168 3194->3195 3206 6db8162-6db8258 call 6db6590 3194->3206 3195->3184 3195->3185 3209 6db7eeb-6db7f13 3197->3209 3210 6db8010-6db8015 3197->3210 3198->3157 3198->3177 3260 6db825a-6db8264 3206->3260 3261 6db8266 3206->3261 3209->3210 3218 6db7f19-6db7f47 3209->3218 3210->3198 3218->3210 3224 6db7f4d-6db7f56 3218->3224 3224->3210 3225 6db7f5c-6db7f8e 3224->3225 3233 6db7f99-6db7fb5 3225->3233 3234 6db7f90-6db7f94 3225->3234 3233->3198 3236 6db7fb7-6db800e call 6db6590 3233->3236 3234->3210 3235 6db7f96 3234->3235 3235->3233 3236->3198 3262 6db826b-6db826d 3260->3262 3261->3262 3262->3195 3263 6db826f-6db8274 3262->3263 3264 6db8282 3263->3264 3265 6db8276-6db8280 3263->3265 3266 6db8287-6db8289 3264->3266 3265->3266 3266->3195 3267 6db828b-6db8297 3266->3267 3267->3195
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 40b6925b7e2802f1e7e9b99879e50437962ca2111fbd7cedb70ba9827446a4d5
                                                          • Instruction ID: 8f2315173aacf22d98cf524c7f8ee9c6f3f352c17657b986b9772ca5348a40e3
                                                          • Opcode Fuzzy Hash: 40b6925b7e2802f1e7e9b99879e50437962ca2111fbd7cedb70ba9827446a4d5
                                                          • Instruction Fuzzy Hash: F3027D30B00205DFDB64DB69D590AAEB7B6FF84350F148529D906DB389EB75EC82CB90
                                                          Function 06DB4B50 Relevance: 3.9, Strings: 3, Instructions: 186COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 6db4b50-6db4b74 1 6db4b76-6db4b79 0->1 2 6db5258-6db525b 1->2 3 6db4b7f-6db4c77 1->3 4 6db525d-6db5277 2->4 5 6db527c-6db527e 2->5 23 6db4cfa-6db4d01 3->23 24 6db4c7d-6db4cca call 6db53f8 3->24 4->5 7 6db5280 5->7 8 6db5285-6db5288 5->8 7->8 8->1 10 6db528e-6db529b 8->10 25 6db4d07-6db4d77 23->25 26 6db4d85-6db4d8e 23->26 37 6db4cd0-6db4cec 24->37 43 6db4d79 25->43 44 6db4d82 25->44 26->10 40 6db4cee 37->40 41 6db4cf7 37->41 40->41 41->23 43->44 44->26
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: fq$XPq$\Oq
                                                          • API String ID: 0-132346853
                                                          • Opcode ID: 70eb56af4d03620911f5fb006dd93b4f520027a09d530b938746846ecb91634a
                                                          • Instruction ID: 98964fbe1168bbd9a954574d339d9c46281c31b9ab808536a56e8be99c40bd01
                                                          • Opcode Fuzzy Hash: 70eb56af4d03620911f5fb006dd93b4f520027a09d530b938746846ecb91634a
                                                          • Instruction Fuzzy Hash: A8615C30F00219AFEB54DBA8D8547AEBBF6FF88700F248429D506AB395DA758C45CB94
                                                          Function 0171EB38 Relevance: 1.7, APIs: 1, Instructions: 155COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 569 171eb38-171eb40 570 171eb42-171eb53 569->570 571 171eaff-171eb18 call 171eb38 569->571 573 171eb55-171eb7c 570->573 574 171eb7d-171eb93 570->574 575 171eb1e-171eb22 571->575 599 171eb95 call 171ec20 574->599 600 171eb95 call 171eb38 574->600 578 171eb24-171eb29 575->578 579 171eb2b-171eb2e 575->579 580 171eb31-171eb33 578->580 579->580 581 171eb9a-171eb9c 582 171eba2-171ec01 581->582 583 171eb9e-171eba1 581->583 590 171ec03-171ec06 582->590 591 171ec07-171ec94 GlobalMemoryStatusEx 582->591 595 171ec96-171ec9c 591->595 596 171ec9d-171ecc5 591->596 595->596 599->581 600->581
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2820414192.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_1710000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 639662ba3d9489018c8d4d0c5f75d171dff34e8cba9c7260681987fe8f2de3db
                                                          • Instruction ID: a63f3fca6b8b5d5813937b276f1bd6d613f6deaa521268c1abf6f7ebd5820e3a
                                                          • Opcode Fuzzy Hash: 639662ba3d9489018c8d4d0c5f75d171dff34e8cba9c7260681987fe8f2de3db
                                                          • Instruction Fuzzy Hash: 90516732E043868FDB25CF69D8046DDBFF5AF86210F0885AAD845E7341DB749885CBA1
                                                          Function 0171EC20 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 734 171ec20-171ec94 GlobalMemoryStatusEx 736 171ec96-171ec9c 734->736 737 171ec9d-171ecc5 734->737 736->737
                                                          APIs
                                                          • GlobalMemoryStatusEx.KERNELBASE ref: 0171EC87
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2820414192.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_1710000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID: GlobalMemoryStatus
                                                          • String ID:
                                                          • API String ID: 1890195054-0
                                                          • Opcode ID: f99c9105f5c4243b3f19d810b68dab1e5bb7d4e94153bdd04b85a58ed064190b
                                                          • Instruction ID: f66631c4a02c8c13e32ee70f142744bc17832677b49609735cca2673becc77e2
                                                          • Opcode Fuzzy Hash: f99c9105f5c4243b3f19d810b68dab1e5bb7d4e94153bdd04b85a58ed064190b
                                                          • Instruction Fuzzy Hash: BB11F0B1C006599BDB10CF9AD945BDEFBF4EF48220F14852AD818A7240D778A945CFA5
                                                          Function 06DB4B40 Relevance: 1.4, Strings: 1, Instructions: 133COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 740 6db4b40-6db4b74 743 6db4b76-6db4b79 740->743 744 6db5258-6db525b 743->744 745 6db4b7f-6db4c77 743->745 746 6db525d-6db5277 744->746 747 6db527c-6db527e 744->747 765 6db4cfa-6db4d01 745->765 766 6db4c7d-6db4cca call 6db53f8 745->766 746->747 749 6db5280 747->749 750 6db5285-6db5288 747->750 749->750 750->743 752 6db528e-6db529b 750->752 767 6db4d07-6db4d77 765->767 768 6db4d85-6db4d8e 765->768 779 6db4cd0-6db4cec 766->779 785 6db4d79 767->785 786 6db4d82 767->786 768->752 782 6db4cee 779->782 783 6db4cf7 779->783 782->783 783->765 785->786 786->768
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: XPq
                                                          • API String ID: 0-1601936878
                                                          • Opcode ID: 2006512bb9a5a9fa27a0ca415907141a9fa541a29fc135448d892f99c9a34f81
                                                          • Instruction ID: 19d09be957a1704ec6af4d5a31ea5baf2b72704677dacc634420f6a7fddbee00
                                                          • Opcode Fuzzy Hash: 2006512bb9a5a9fa27a0ca415907141a9fa541a29fc135448d892f99c9a34f81
                                                          • Instruction Fuzzy Hash: F0517E30F00218AFDB55DFA9C854B9EBBF6FF88700F208529D106AB395DA758C45CB94
                                                          Function 06DBCF28 Relevance: .8, Instructions: 798COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1560 6dbcf28-6dbcf43 1561 6dbcf45-6dbcf48 1560->1561 1562 6dbcf4a-6dbcf8c 1561->1562 1563 6dbcf91-6dbcf94 1561->1563 1562->1563 1564 6dbcf9a-6dbcf9d 1563->1564 1565 6dbd414-6dbd420 1563->1565 1566 6dbcf9f-6dbcfae 1564->1566 1567 6dbcfe6-6dbcfe9 1564->1567 1569 6dbd122-6dbd131 1565->1569 1570 6dbd426-6dbd713 1565->1570 1571 6dbcfbd-6dbcfc9 1566->1571 1572 6dbcfb0-6dbcfb5 1566->1572 1573 6dbcfeb-6dbd02d 1567->1573 1574 6dbd032-6dbd035 1567->1574 1575 6dbd133-6dbd138 1569->1575 1576 6dbd140-6dbd14c 1569->1576 1773 6dbd93a-6dbd944 1570->1773 1774 6dbd719-6dbd71f 1570->1774 1577 6dbcfcf-6dbcfe1 1571->1577 1578 6dbd945-6dbd97e 1571->1578 1572->1571 1573->1574 1579 6dbd07e-6dbd081 1574->1579 1580 6dbd037-6dbd079 1574->1580 1575->1576 1576->1578 1583 6dbd152-6dbd164 1576->1583 1577->1567 1599 6dbd980-6dbd983 1578->1599 1584 6dbd083-6dbd09f 1579->1584 1585 6dbd0a4-6dbd0a7 1579->1585 1580->1579 1595 6dbd169-6dbd16c 1583->1595 1584->1585 1588 6dbd0a9-6dbd0eb 1585->1588 1589 6dbd0f0-6dbd0f3 1585->1589 1588->1589 1597 6dbd0fd-6dbd100 1589->1597 1598 6dbd0f5-6dbd0fa 1589->1598 1601 6dbd17b-6dbd17e 1595->1601 1602 6dbd16e-6dbd170 1595->1602 1603 6dbd11d-6dbd120 1597->1603 1604 6dbd102-6dbd118 1597->1604 1598->1597 1609 6dbd9a6-6dbd9a9 1599->1609 1610 6dbd985-6dbd9a1 1599->1610 1616 6dbd180-6dbd1c2 1601->1616 1617 6dbd1c7-6dbd1ca 1601->1617 1611 6dbd411 1602->1611 1612 6dbd176 1602->1612 1603->1569 1603->1595 1604->1603 1613 6dbd9ab call 6dbda9d 1609->1613 1614 6dbd9b8-6dbd9bb 1609->1614 1610->1609 1611->1565 1612->1601 1632 6dbd9b1-6dbd9b3 1613->1632 1625 6dbd9ee-6dbd9f0 1614->1625 1626 6dbd9bd-6dbd9e9 1614->1626 1616->1617 1619 6dbd1cc-6dbd20e 1617->1619 1620 6dbd213-6dbd216 1617->1620 1619->1620 1630 6dbd218-6dbd21a 1620->1630 1631 6dbd225-6dbd228 1620->1631 1634 6dbd9f2 1625->1634 1635 6dbd9f7-6dbd9fa 1625->1635 1626->1625 1639 6dbd2cf-6dbd2d8 1630->1639 1640 6dbd220 1630->1640 1641 6dbd22a-6dbd26c 1631->1641 1642 6dbd271-6dbd274 1631->1642 1632->1614 1634->1635 1635->1599 1644 6dbd9fc-6dbda0b 1635->1644 1648 6dbd2da-6dbd2df 1639->1648 1649 6dbd2e7-6dbd2f3 1639->1649 1640->1631 1641->1642 1651 6dbd2bd-6dbd2bf 1642->1651 1652 6dbd276-6dbd2b8 1642->1652 1665 6dbda0d-6dbda70 call 6db6590 1644->1665 1666 6dbda72-6dbda87 1644->1666 1648->1649 1657 6dbd2f9-6dbd30d 1649->1657 1658 6dbd404-6dbd409 1649->1658 1655 6dbd2c1 1651->1655 1656 6dbd2c6-6dbd2c9 1651->1656 1652->1651 1655->1656 1656->1561 1656->1639 1657->1611 1676 6dbd313-6dbd325 1657->1676 1658->1611 1665->1666 1681 6dbda88 1666->1681 1689 6dbd349-6dbd34b 1676->1689 1690 6dbd327-6dbd32d 1676->1690 1681->1681 1694 6dbd355-6dbd361 1689->1694 1695 6dbd32f 1690->1695 1696 6dbd331-6dbd33d 1690->1696 1706 6dbd36f 1694->1706 1707 6dbd363-6dbd36d 1694->1707 1698 6dbd33f-6dbd347 1695->1698 1696->1698 1698->1694 1709 6dbd374-6dbd376 1706->1709 1707->1709 1709->1611 1711 6dbd37c-6dbd398 call 6db6590 1709->1711 1719 6dbd39a-6dbd39f 1711->1719 1720 6dbd3a7-6dbd3b3 1711->1720 1719->1720 1720->1658 1722 6dbd3b5-6dbd402 1720->1722 1722->1611 1775 6dbd72e-6dbd737 1774->1775 1776 6dbd721-6dbd726 1774->1776 1775->1578 1777 6dbd73d-6dbd750 1775->1777 1776->1775 1779 6dbd92a-6dbd934 1777->1779 1780 6dbd756-6dbd75c 1777->1780 1779->1773 1779->1774 1781 6dbd76b-6dbd774 1780->1781 1782 6dbd75e-6dbd763 1780->1782 1781->1578 1783 6dbd77a-6dbd79b 1781->1783 1782->1781 1786 6dbd7aa-6dbd7b3 1783->1786 1787 6dbd79d-6dbd7a2 1783->1787 1786->1578 1788 6dbd7b9-6dbd7d6 1786->1788 1787->1786 1788->1779 1791 6dbd7dc-6dbd7e2 1788->1791 1791->1578 1792 6dbd7e8-6dbd801 1791->1792 1794 6dbd91d-6dbd924 1792->1794 1795 6dbd807-6dbd82e 1792->1795 1794->1779 1794->1791 1795->1578 1798 6dbd834-6dbd83e 1795->1798 1798->1578 1799 6dbd844-6dbd85b 1798->1799 1801 6dbd86a-6dbd885 1799->1801 1802 6dbd85d-6dbd868 1799->1802 1801->1794 1807 6dbd88b-6dbd8a4 call 6db6590 1801->1807 1802->1801 1811 6dbd8b3-6dbd8bc 1807->1811 1812 6dbd8a6-6dbd8ab 1807->1812 1811->1578 1813 6dbd8c2-6dbd916 1811->1813 1812->1811 1813->1794
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5c935ae9a582ae4cf013b75d1d8e9afd30f370bb648bd371f6c51506d6987072
                                                          • Instruction ID: 8219029fece2ee12a10cb67b8a83f0970f208824b0d2d048fffb432708428483
                                                          • Opcode Fuzzy Hash: 5c935ae9a582ae4cf013b75d1d8e9afd30f370bb648bd371f6c51506d6987072
                                                          • Instruction Fuzzy Hash: EB621C30A10206DFDB55EF68D590A9DB7B3FF84740B208968D0469F359EB79EC86CB81
                                                          Function 06DBC170 Relevance: .6, Instructions: 644COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1821 6dbc170-6dbc18e 1822 6dbc190-6dbc193 1821->1822 1823 6dbc1be-6dbc1c1 1822->1823 1824 6dbc195-6dbc1b9 1822->1824 1825 6dbc1c3-6dbc1ca 1823->1825 1826 6dbc1d5-6dbc1d8 1823->1826 1824->1823 1828 6dbc4e3-6dbc4e6 1825->1828 1829 6dbc1d0 1825->1829 1830 6dbc1ea-6dbc1ed 1826->1830 1831 6dbc1da-6dbc1e5 1826->1831 1832 6dbc4eb-6dbc4ed 1828->1832 1829->1826 1833 6dbc1ef-6dbc1f8 1830->1833 1834 6dbc203-6dbc206 1830->1834 1831->1830 1841 6dbc4ef 1832->1841 1842 6dbc4f4-6dbc4f7 1832->1842 1835 6dbc399-6dbc3a2 1833->1835 1836 6dbc1fe 1833->1836 1837 6dbc208-6dbc211 1834->1837 1838 6dbc21c-6dbc21f 1834->1838 1848 6dbc508-6dbc53d 1835->1848 1849 6dbc3a8-6dbc3af 1835->1849 1836->1834 1844 6dbc4ba-6dbc4c3 1837->1844 1845 6dbc217 1837->1845 1846 6dbc24a-6dbc24d 1838->1846 1847 6dbc221-6dbc245 1838->1847 1841->1842 1842->1822 1843 6dbc4fd-6dbc507 1842->1843 1844->1848 1852 6dbc4c5-6dbc4cc 1844->1852 1845->1838 1853 6dbc24f-6dbc271 1846->1853 1854 6dbc276-6dbc279 1846->1854 1847->1846 1864 6dbc53f-6dbc542 1848->1864 1850 6dbc3b4-6dbc3b7 1849->1850 1855 6dbc3b9-6dbc3bc 1850->1855 1856 6dbc3c1-6dbc3c4 1850->1856 1861 6dbc4d1-6dbc4d4 1852->1861 1853->1854 1858 6dbc27b-6dbc28c 1854->1858 1859 6dbc291-6dbc294 1854->1859 1855->1856 1862 6dbc3d1-6dbc3d4 1856->1862 1863 6dbc3c6-6dbc3cc 1856->1863 1858->1859 1865 6dbc296-6dbc2b0 1859->1865 1866 6dbc2b5-6dbc2b8 1859->1866 1867 6dbc4de-6dbc4e1 1861->1867 1868 6dbc4d6-6dbc4d9 1861->1868 1870 6dbc3d6-6dbc3f0 1862->1870 1871 6dbc3f5-6dbc3f8 1862->1871 1863->1862 1872 6dbc56e-6dbc571 1864->1872 1873 6dbc544-6dbc55d 1864->1873 1865->1866 1876 6dbc2ba-6dbc311 1866->1876 1877 6dbc316-6dbc319 1866->1877 1867->1828 1867->1832 1868->1867 1870->1871 1879 6dbc3fa-6dbc3ff 1871->1879 1880 6dbc402-6dbc405 1871->1880 1882 6dbc57e-6dbc581 1872->1882 1883 6dbc573-6dbc57d 1872->1883 1916 6dbc5f3-6dbc5ff 1873->1916 1917 6dbc563-6dbc56d 1873->1917 1876->1877 1884 6dbc31b-6dbc321 1877->1884 1885 6dbc326-6dbc329 1877->1885 1879->1880 1888 6dbc40f-6dbc412 1880->1888 1889 6dbc407-6dbc40c 1880->1889 1891 6dbc583-6dbc59f 1882->1891 1892 6dbc5a4-6dbc5a7 1882->1892 1884->1885 1885->1837 1893 6dbc32f-6dbc332 1885->1893 1900 6dbc42a-6dbc42d 1888->1900 1901 6dbc414-6dbc423 1888->1901 1889->1888 1891->1892 1898 6dbc5a9-6dbc5b7 1892->1898 1899 6dbc5be-6dbc5c1 1892->1899 1895 6dbc355-6dbc358 1893->1895 1896 6dbc334-6dbc350 1893->1896 1906 6dbc35a-6dbc36b 1895->1906 1907 6dbc370-6dbc373 1895->1907 1896->1895 1898->1873 1930 6dbc5b9 1898->1930 1908 6dbc5c3-6dbc5dc 1899->1908 1909 6dbc5e1-6dbc5e3 1899->1909 1904 6dbc459-6dbc45c 1900->1904 1905 6dbc42f-6dbc454 1900->1905 1901->1855 1921 6dbc425 1901->1921 1904->1833 1913 6dbc462-6dbc465 1904->1913 1905->1904 1906->1907 1914 6dbc375-6dbc38f 1907->1914 1915 6dbc394-6dbc397 1907->1915 1908->1909 1918 6dbc5ea-6dbc5ed 1909->1918 1919 6dbc5e5 1909->1919 1926 6dbc467-6dbc481 1913->1926 1927 6dbc486-6dbc489 1913->1927 1914->1915 1915->1835 1915->1850 1922 6dbc79f-6dbc7a9 1916->1922 1923 6dbc605-6dbc60e 1916->1923 1918->1864 1918->1916 1919->1918 1921->1900 1932 6dbc7aa-6dbc7de 1923->1932 1933 6dbc614-6dbc634 1923->1933 1926->1927 1936 6dbc48b-6dbc4b0 1927->1936 1937 6dbc4b5-6dbc4b8 1927->1937 1930->1899 1947 6dbc7e0-6dbc7e3 1932->1947 1954 6dbc63a-6dbc643 1933->1954 1955 6dbc78d-6dbc799 1933->1955 1936->1937 1937->1844 1937->1861 1950 6dbc806-6dbc809 1947->1950 1951 6dbc7e5-6dbc801 1947->1951 1952 6dbc80f-6dbc81d 1950->1952 1953 6dbc9c3-6dbc9c5 1950->1953 1951->1950 1963 6dbc824-6dbc826 1952->1963 1957 6dbc9cc-6dbc9cf 1953->1957 1958 6dbc9c7 1953->1958 1954->1932 1959 6dbc649-6dbc678 call 6db6590 1954->1959 1955->1922 1955->1923 1957->1947 1962 6dbc9d5-6dbc9de 1957->1962 1958->1957 1976 6dbc6ba-6dbc6d0 1959->1976 1977 6dbc67a-6dbc6b2 1959->1977 1965 6dbc828-6dbc82b 1963->1965 1966 6dbc83d-6dbc867 1963->1966 1965->1962 1974 6dbc9b8-6dbc9c2 1966->1974 1975 6dbc86d-6dbc876 1966->1975 1978 6dbc87c-6dbc989 call 6db6590 1975->1978 1979 6dbc991-6dbc9b6 1975->1979 1984 6dbc6ee-6dbc704 1976->1984 1985 6dbc6d2-6dbc6e6 1976->1985 1977->1976 1978->1975 2028 6dbc98f 1978->2028 1979->1962 1991 6dbc722-6dbc735 1984->1991 1992 6dbc706-6dbc71a 1984->1992 1985->1984 1998 6dbc743 1991->1998 1999 6dbc737-6dbc741 1991->1999 1992->1991 2002 6dbc748-6dbc74a 1998->2002 1999->2002 2003 6dbc77b-6dbc787 2002->2003 2004 6dbc74c-6dbc751 2002->2004 2003->1954 2003->1955 2006 6dbc75f 2004->2006 2007 6dbc753-6dbc75d 2004->2007 2008 6dbc764-6dbc766 2006->2008 2007->2008 2008->2003 2010 6dbc768-6dbc774 2008->2010 2010->2003 2028->1974
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 85877542a95d05984fb99d1c2d3251be16e2e0e9bbbfe2194be4a570e37b51fa
                                                          • Instruction ID: 413e129159b9837c995c81fdc2a575c2a5c2f38c34bda2cfae7bc2e8937d72df
                                                          • Opcode Fuzzy Hash: 85877542a95d05984fb99d1c2d3251be16e2e0e9bbbfe2194be4a570e37b51fa
                                                          • Instruction Fuzzy Hash: B2328D34B10209DFDB64DB68D890BAEB7B2FB88310F108429D506EB344DB79EC81CB91
                                                          Function 06DBB630 Relevance: .5, Instructions: 476COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e45df431c73dc91f39c475da98ce2d89675190a44af7424c02154f5f5997646f
                                                          • Instruction ID: 70cacfa04a2593f7c2c73fae5dee611c8072ddb5654b14a23a9009473e806f16
                                                          • Opcode Fuzzy Hash: e45df431c73dc91f39c475da98ce2d89675190a44af7424c02154f5f5997646f
                                                          • Instruction Fuzzy Hash: 73024830E10209DFDBA4CB69D880AADB7B2FB45310F20956AD446EB359DF74EC81CB95
                                                          Function 06DB9138 Relevance: .2, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e18d0d0669b61e00b071a20c504cbc34a07161758b0da9a3025a5c69ae7367af
                                                          • Instruction ID: acfc527c8cd90353e11cf48d86d08a9892c0240958cea32ae91053bcaf7263b3
                                                          • Opcode Fuzzy Hash: e18d0d0669b61e00b071a20c504cbc34a07161758b0da9a3025a5c69ae7367af
                                                          • Instruction Fuzzy Hash: 8B917F74B002099FDB64DF69C9A07AE77B6FF89340F108469C50AEB344EE75EC918B91
                                                          Function 06DB61E0 Relevance: .2, Instructions: 229COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 32c27237fbd5bb14b154060e533b69f1a3de782b343ae3cbfb9b91d8e6bb8eaf
                                                          • Instruction ID: 1e2fb922e667cff520a457083b1ab480d3e8a746b0e076a496aa180405529208
                                                          • Opcode Fuzzy Hash: 32c27237fbd5bb14b154060e533b69f1a3de782b343ae3cbfb9b91d8e6bb8eaf
                                                          • Instruction Fuzzy Hash: 0B61C372F001118FDF659B6DC8806AEBAEBAFD4210B154439E80BEB365DEB5DC0287C5
                                                          Function 06DB4280 Relevance: .2, Instructions: 227COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 608f7ed769fe2f3dcdaffd4fcc9f82f04361cae445729af8a66ee5184c875209
                                                          • Instruction ID: 38442391b2c9c026a92139879f7497de9956f26a6b742d6cc8e6c144cfc26904
                                                          • Opcode Fuzzy Hash: 608f7ed769fe2f3dcdaffd4fcc9f82f04361cae445729af8a66ee5184c875209
                                                          • Instruction Fuzzy Hash: FB814F34B002059FDB54DFA9D4947AE7BF3BF89300F108529D40AEB349EA75DC928B91
                                                          Function 06DB45A0 Relevance: .2, Instructions: 224COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1a33db84ce23a47c8a217cad06c05d31ae8ca737fa543edc3a678df4e20320ab
                                                          • Instruction ID: 84ae9a231d0ede113a99242a48a4cd43576994e34ff965b0458208a005ec4a06
                                                          • Opcode Fuzzy Hash: 1a33db84ce23a47c8a217cad06c05d31ae8ca737fa543edc3a678df4e20320ab
                                                          • Instruction Fuzzy Hash: FA912B34E102198FDB60DF68C890BDDB7B1FF89310F208699D549AB355DB70AA85CB91
                                                          Function 06DBAF08 Relevance: .2, Instructions: 215COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cc8d488d9b01885be031b7f7a02056b65e0a68eb7ad00f7dc8123bd005ad7e19
                                                          • Instruction ID: 9b6efebb8b3067ccd2b8b63f5614b236d8a36e662f242fcaf5ba15c625a0723a
                                                          • Opcode Fuzzy Hash: cc8d488d9b01885be031b7f7a02056b65e0a68eb7ad00f7dc8123bd005ad7e19
                                                          • Instruction Fuzzy Hash: A3714F70E1031ADFDB15DF69D8906AEB7B2FF85300F148529D406AB344EF759986CB81
                                                          Function 06DB45B8 Relevance: .2, Instructions: 210COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c65ca2d21b3f048fa3ba93331d9823c72cfa5da85c411feca978ed1ca5fd5656
                                                          • Instruction ID: f9d22e3d95144eadac3959871a5467509a562e18ae908a3d1eee5c56c63b8893
                                                          • Opcode Fuzzy Hash: c65ca2d21b3f048fa3ba93331d9823c72cfa5da85c411feca978ed1ca5fd5656
                                                          • Instruction Fuzzy Hash: BE912A34E106198BDF64DF68C890BDDB7B1FF89310F208699D549AB345EB70AA85CF90
                                                          Function 06DBEEF0 Relevance: .2, Instructions: 209COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 939513bae1268b174130cfb7dd229f81cc3fc4624c8cec08ef66b9eb1b56338f
                                                          • Instruction ID: 9a62341173f2bbed41f806ceb31c37c1f976c607c3b059044bc84edbd2cf7212
                                                          • Opcode Fuzzy Hash: 939513bae1268b174130cfb7dd229f81cc3fc4624c8cec08ef66b9eb1b56338f
                                                          • Instruction Fuzzy Hash: BF812970A00249DFDB54DBA9D980ADDBBF6FF88300F248529D406AB359DB34ED46CB50
                                                          Function 06DBEF00 Relevance: .2, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4b6a3222d70c7b4bc09c69593741215546504be8524e9e6406b15cffa255a0f9
                                                          • Instruction ID: e0bcaae907676147603d51ad01b24cd9b695bdfcca57813c8963c507bfcf80f9
                                                          • Opcode Fuzzy Hash: 4b6a3222d70c7b4bc09c69593741215546504be8524e9e6406b15cffa255a0f9
                                                          • Instruction Fuzzy Hash: 43712970A00209DFDB54DBA9D980ADEBBF6FF88340F249429E416AB359DB34ED41CB50
                                                          Function 06DBFC58 Relevance: .2, Instructions: 179COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d2709d35266814ec887d1ddd1427edfc1422e825674c083188a591943fb89d4b
                                                          • Instruction ID: c2e88b22bd0719c2381ee6d40f33bb100d0988df79e3594dcb8ede7656986af4
                                                          • Opcode Fuzzy Hash: d2709d35266814ec887d1ddd1427edfc1422e825674c083188a591943fb89d4b
                                                          • Instruction Fuzzy Hash: 2F51C131F01209DFDB64ABB8E8946EEBBB2FB84311F208879E106D7354DB359955C790
                                                          Function 06DBFA09 Relevance: .2, Instructions: 171COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c629339597c0abac950a546752067bad7f571b43c903d9be3ab0ac83b97dc88b
                                                          • Instruction ID: c518008131e2ce18b042c98c8dc9cf9f8321dcdb704b84c7f4bb9e62d9f71268
                                                          • Opcode Fuzzy Hash: c629339597c0abac950a546752067bad7f571b43c903d9be3ab0ac83b97dc88b
                                                          • Instruction Fuzzy Hash: 10519170B20214DFEF645BA8DC94BAE366AE789750F20443AE40BD77D4D97CCC818796
                                                          Function 06DBFA18 Relevance: .2, Instructions: 163COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c37a5bdfb083c4e36a3ff099b85fd772c2a76427037434797d1192888055175c
                                                          • Instruction ID: 988b8ea147cf8c25abff9b12bd11edc81c6385f1dcc980b2c8a14cdd43a6fe46
                                                          • Opcode Fuzzy Hash: c37a5bdfb083c4e36a3ff099b85fd772c2a76427037434797d1192888055175c
                                                          • Instruction Fuzzy Hash: A45191B0B20204DFEF645BA9DC94B6E326AE789750F20443AE40BD77D8D96CCC814795
                                                          Function 06DB9127 Relevance: .2, Instructions: 162COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ee4a315c71b1be76a53a8bb878703dd0cfb3bc9ea77ca29339b7a030bb8ea6d1
                                                          • Instruction ID: 4513a7ccc4c54594f36a3008963573f9f9c8078a3f46b568088437e91ee28366
                                                          • Opcode Fuzzy Hash: ee4a315c71b1be76a53a8bb878703dd0cfb3bc9ea77ca29339b7a030bb8ea6d1
                                                          • Instruction Fuzzy Hash: 17518F74B001049FDB64DB79D9A0BAE77A6FBC9340F108429C50AEB344EE75ECA18B91
                                                          Function 06DB53F8 Relevance: .1, Instructions: 136COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: dd85496bd29e3ea2d7729e2f3d9ea8f1440482f69c3e5320f54c82953ccbe1ed
                                                          • Instruction ID: ae64776f4135557d2244e52d493cfd97cd04d74c0e4109109962d1b4b76eebb1
                                                          • Opcode Fuzzy Hash: dd85496bd29e3ea2d7729e2f3d9ea8f1440482f69c3e5320f54c82953ccbe1ed
                                                          • Instruction Fuzzy Hash: 86418E31E00609CFDB70CFA9E880ABFF7F2EB88211F10492AD15AD7654D231E9598B91
                                                          Function 06DBDA9D Relevance: .1, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1983c129cd666adefaa62c5c2179e8ffb420aba1588061124d2eb4258b99cd86
                                                          • Instruction ID: fc6cecd27021515446c6b1416e9b8b081adc3d52e2036c6c2c0200d7dae0e473
                                                          • Opcode Fuzzy Hash: 1983c129cd666adefaa62c5c2179e8ffb420aba1588061124d2eb4258b99cd86
                                                          • Instruction Fuzzy Hash: 1F416A30E00209DFDB659F65C894AAEBBB3BF85300F208529E416EB244EB75D946CB91
                                                          Function 06DB21D0 Relevance: .1, Instructions: 105COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2d9341ddb26eb8de3407732755913683ff9a8355a44bb5bfddf2d883cdec9f4c
                                                          • Instruction ID: 193cd21f26cffa5d1b9b1444fa01e844e9ce954a786b77a3cb21b490c237c341
                                                          • Opcode Fuzzy Hash: 2d9341ddb26eb8de3407732755913683ff9a8355a44bb5bfddf2d883cdec9f4c
                                                          • Instruction Fuzzy Hash: 3A31AB31B10205AFDB699B74C9547BE3AA6BF89340F20542CD406DB388EE3ADD45CBA5
                                                          Function 06DBD950 Relevance: .1, Instructions: 98COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1d8eeea0412ae4cb09b2febf8ae0bf95196f09e0dddf7fff4ebe96a896c6a787
                                                          • Instruction ID: fc55ecaa8f185a587f720769313480b24f545dd705a34733251973bdbe469115
                                                          • Opcode Fuzzy Hash: 1d8eeea0412ae4cb09b2febf8ae0bf95196f09e0dddf7fff4ebe96a896c6a787
                                                          • Instruction Fuzzy Hash: DF317030E1420ACFDF25DF64C890ADEBBB6FF85200F108529E406EB644EBB5E9468B51
                                                          Function 06DB2083 Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e6ae05fe4596b2f035bcc387bca6e5556241139517619015fa0bbc22c3935bf3
                                                          • Instruction ID: dc080dded850bb6782abb8e9fef83e6c5c74343904a0746837a9c7aa7d014661
                                                          • Opcode Fuzzy Hash: e6ae05fe4596b2f035bcc387bca6e5556241139517619015fa0bbc22c3935bf3
                                                          • Instruction Fuzzy Hash: C9315C35E10206DFCB15CF68D894AAEB7B2FF89300F148529E916EB344DB71E982CB40
                                                          Function 06DB2090 Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: eafb34f73e880714665442f7b876f54cd642b966b31f07a7ae4f0e3d441c499f
                                                          • Instruction ID: b151e2b693bbf2f70193306ec3cf4df123a690c1a1437eab83286ee5d7daad7e
                                                          • Opcode Fuzzy Hash: eafb34f73e880714665442f7b876f54cd642b966b31f07a7ae4f0e3d441c499f
                                                          • Instruction Fuzzy Hash: C6318E35E1020ADBCB19CF65D894AAEB7B2FF89300F108529E916E7344DB71ED82CB50
                                                          Function 06DB3A80 Relevance: .1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 58ed8cbbf80113e2879456656b6f5af4782e1a62b945d2f5d0793456eb853d7c
                                                          • Instruction ID: 60b84ef3e053872e4f3f0a6552b23aa97bb35982686b21e06136a5be49e7d48e
                                                          • Opcode Fuzzy Hash: 58ed8cbbf80113e2879456656b6f5af4782e1a62b945d2f5d0793456eb853d7c
                                                          • Instruction Fuzzy Hash: 2B217C39F00205AFDB50CF69E881AEEBBF6FB48710F108025E90AE7744EA35D9419BD4
                                                          Function 06DB3A90 Relevance: .1, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e05d619ab71865d30d5d2028f136f9b391490db01801c056503184653e417178
                                                          • Instruction ID: aab4c155ee5cbbe2a54ea7b2ea890eaaf3402a50716301dd518c1ddeb07d86ee
                                                          • Opcode Fuzzy Hash: e05d619ab71865d30d5d2028f136f9b391490db01801c056503184653e417178
                                                          • Instruction Fuzzy Hash: 05212775E00615EFDB50CF69D981AEEBBB1FB48710F118029EA4AE7354EB35D8408B94
                                                          Function 016CD030 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2820070907.00000000016CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016CD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_16cd000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c53fd82ffcb98872460a2cfdd45f990de313361acdaefd6a7452301bc44c341b
                                                          • Instruction ID: a6540f4fe15a1a7364866dbdb5cf504e7769871bac6865635cd08de36828ac65
                                                          • Opcode Fuzzy Hash: c53fd82ffcb98872460a2cfdd45f990de313361acdaefd6a7452301bc44c341b
                                                          • Instruction Fuzzy Hash: B9210371604244DFDB15DF58DDC0B26BB61EB84614F20C57ED8090B392C33AD447CAA2
                                                          Function 06DB3BA0 Relevance: .1, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f51cebb4be93b2ab8cd3caafc2b7694232d6c44c741ae5a1560260995b469282
                                                          • Instruction ID: f632ae2fc7411ee4083007135036c3abcece27dc7f8f8ce8d545e1fe237b0d13
                                                          • Opcode Fuzzy Hash: f51cebb4be93b2ab8cd3caafc2b7694232d6c44c741ae5a1560260995b469282
                                                          • Instruction Fuzzy Hash: 56118E31B00124AFDB649A68C8146EF77AAEBC8310B014439D50AE7344EE25DC5287D4
                                                          Function 06DBF171 Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 28ad5e046a0c2e801839fad1553bc34160b9fb1f4c7241b3d13ac29e4204ecf0
                                                          • Instruction ID: 50ae2ab7ea71bf1e2b8dcd5413cb202be23acef5a71e4b29a069dd25c705ed0d
                                                          • Opcode Fuzzy Hash: 28ad5e046a0c2e801839fad1553bc34160b9fb1f4c7241b3d13ac29e4204ecf0
                                                          • Instruction Fuzzy Hash: 0901B175F001105FDB669B3CDC90BAF67E6EBC96A0B148929E00BC7345DE29DC0243D1
                                                          Function 06DB3859 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 157060b1190eda6765459613ea97ef78ffe317a94118b2d5ed9390029cc97d0e
                                                          • Instruction ID: e77c4e9e7d05d7b17c1acdeba1b2d3580fb12e383cd1f7701d5291a78a8955f7
                                                          • Opcode Fuzzy Hash: 157060b1190eda6765459613ea97ef78ffe317a94118b2d5ed9390029cc97d0e
                                                          • Instruction Fuzzy Hash: AB21F2B5D01259EFDB10CF9AD884ADEFBB8FB49310F10852AE918A7200C374A944CFA5
                                                          Function 06DB41E1 Relevance: .1, Instructions: 57COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 040e33456f1e72b853b01f42a9d12f202abcc85ee9e02dd0a2b423ff2584eea0
                                                          • Instruction ID: 0ff83b5f3782d3a790fb676bf8de4c95fdd494a116026daab8582c2fdff8ffd4
                                                          • Opcode Fuzzy Hash: 040e33456f1e72b853b01f42a9d12f202abcc85ee9e02dd0a2b423ff2584eea0
                                                          • Instruction Fuzzy Hash: 3E01F134B041519FDB71DABCD84075FB7DAEFCA760F24882AE10AC739AD969CC424391
                                                          Function 06DBA2F0 Relevance: .1, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0180207d3afb3c74515cd1815b9ffe0997375229a8e959639f213ef5199c7773
                                                          • Instruction ID: 6ef1f621da6281ba80329c26c9861f7d257a6b2638b319fae0ee91d2376c0ebe
                                                          • Opcode Fuzzy Hash: 0180207d3afb3c74515cd1815b9ffe0997375229a8e959639f213ef5199c7773
                                                          • Instruction Fuzzy Hash: C301D230B001109FC7619BB8E850B9EB7E1EB86750F10882DD00BC7344DA25EC8187C0
                                                          Function 06DB3B8F Relevance: .1, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f8b4154f551df3180ce5e8a8e82966ca6418d693b0253cfc0323c5b00d98dfbf
                                                          • Instruction ID: bb18c2996aecb6fc2520464488bf87aaa443c601691d9388809ccb6e4114eda5
                                                          • Opcode Fuzzy Hash: f8b4154f551df3180ce5e8a8e82966ca6418d693b0253cfc0323c5b00d98dfbf
                                                          • Instruction Fuzzy Hash: F5012232B04165AFDBA18AADD8246EF7BAAEFC4310F05043ED846D3284EE21885687C5
                                                          Function 016CD02B Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2820070907.00000000016CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016CD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_16cd000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction ID: bc8cd2148729e4a1e9d188bb3db0e26f3e63aaae17d939f80add43c29ad67cc1
                                                          • Opcode Fuzzy Hash: 5930c3722e95abe2067eb95ddfb8aa1848112c8b53b048d5b6b565b5491e75cf
                                                          • Instruction Fuzzy Hash: 5D11A975604280CFCB16CF58D9C0B25BBA1FB84614F28C6AED8494B756C33AD44ACBA2
                                                          Function 06DB3860 Relevance: .1, Instructions: 52COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 620bb5acb1f3ee5cfcdb8a54e77168fd5e4f99e5f4119ea98872e6df421913d2
                                                          • Instruction ID: 2e148ced42ecf7580f41edb7703b0db2a24f5b031aabe39fcc59fa60efea8fc7
                                                          • Opcode Fuzzy Hash: 620bb5acb1f3ee5cfcdb8a54e77168fd5e4f99e5f4119ea98872e6df421913d2
                                                          • Instruction Fuzzy Hash: BD11D3B5D01259AFCB10CF9AD884ADEFBB4FB48310F10812AE918A7200C374A944CFA5
                                                          Function 06DB41F0 Relevance: .1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cdbae0aee0a62d21e275ef63596c4f6a39592a20683fa251bc184d92cc80ae34
                                                          • Instruction ID: 91055ab8ac9762042bf75d2f4ee5311d7acc30071b043e0ae270c4aade51617f
                                                          • Opcode Fuzzy Hash: cdbae0aee0a62d21e275ef63596c4f6a39592a20683fa251bc184d92cc80ae34
                                                          • Instruction Fuzzy Hash: 8801AD35B000119BDB74DAADE84476BA2DAEBC9760F20883AE10BC7349EA65DC424395
                                                          Function 06DBF180 Relevance: .0, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 80c71f0c040a2ace2d596f37d5991c6419b6ee9a0db1073da6867c7d0d67f297
                                                          • Instruction ID: c4fec8ba506d37009a1aa5b54545102591736d59c4c505ccc3648b5eccc3f9be
                                                          • Opcode Fuzzy Hash: 80c71f0c040a2ace2d596f37d5991c6419b6ee9a0db1073da6867c7d0d67f297
                                                          • Instruction Fuzzy Hash: 7E01DC75F000119BDB65DB3CDC90B6F62DAEBC96A0F248839E10BC7344EE29EC024381
                                                          Function 06DBA300 Relevance: .0, Instructions: 46COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6330e666eb7c8accab2f39a93ac3c6010411358f43072efd2bc6274c8ebbcd5f
                                                          • Instruction ID: 87b6e4aa6368ece6b4df0b0f25811d2eba005c67dd51995bbf18c76d7be440e1
                                                          • Opcode Fuzzy Hash: 6330e666eb7c8accab2f39a93ac3c6010411358f43072efd2bc6274c8ebbcd5f
                                                          • Instruction Fuzzy Hash: E8016D34B101109BDB61DAACE890B5EB3D5EB89650F108829E50BD7344EA26EC4187C0
                                                          Function 06DB82DE Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a3fc35e48a4c45d1b52a748e6b6d11959e47b358e5b22d6b09e9e309f74cfe9b
                                                          • Instruction ID: 338e4ead2706d65ca1543d2b679a2b3d4ec1f853f8ed151ff9a125adeebb6766
                                                          • Opcode Fuzzy Hash: a3fc35e48a4c45d1b52a748e6b6d11959e47b358e5b22d6b09e9e309f74cfe9b
                                                          • Instruction Fuzzy Hash: A6F0A036E04200DFEF645E86E9502E873A8EB00251F041066CE03D3348D63AD950EA90
                                                          Function 06DB6461 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 0000000E.00000002.2833139770.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_14_2_6db0000_gdJhjh.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b8c825b23e50df87c7dd06301bfc89ec7ec72372bccc2c3e5b7662c6ba025add
                                                          • Instruction ID: 653fc52a5f29368673c17f51008d9358d91c00f78dcc8a9c9b812ab62612d38e
                                                          • Opcode Fuzzy Hash: b8c825b23e50df87c7dd06301bfc89ec7ec72372bccc2c3e5b7662c6ba025add
                                                          • Instruction Fuzzy Hash: 4BF02B70E08688DFDB60CF70841469A77A9D745204F204CA5D446C7189E132D9008351